Is Your AI Lying?

The most dangerous insider in your company now has perfect credentials, infinite patience, and no idea it has been turned.

There is a category of threat that every security tool ever built was designed to miss, and we have just deployed hundreds of thousands of them into the most sensitive systems we own.

An AI agent sits inside the enterprise network with direct access to production databases, code repositories, financial systems and customer data. It was given that access deliberately — that is the entire point of it. It authenticates with valid credentials, because they are its credentials. It executes approved actions, because the actions are what we asked it to do. And if it is compromised — prompt-injected, weaponised, or quietly steered off-task — it goes on authenticating with valid credentials and executing approved actions, right up until the damage is done.

This is the ultimate insider threat, and it operates with perfect papers. A single compromised agent can do more damage in minutes than a human insider could in months, because it never sleeps, never hesitates, and its blast radius is bounded only by its permissions. And the uncomfortable part is not that we lack a defence. It is that the defences we already trust are structurally blind to it.

Why your security stack can’t see it

Walk the stack and watch each tool ask the wrong question.

EDR asks: is this malware? It looks for known-bad patterns, signatures, suspicious binaries. A compromised agent runs no malware. It uses the tools it was issued, in the way it was issued them.

SIEM correlates logs. But every log entry the agent generates is, on its face, legitimate — an authorised identity performing authorised actions. Correlate a thousand legitimate events and you get a thousand legitimate events.

Firewalls filter traffic. The agent’s traffic is to systems it is explicitly permitted to reach.

None of them is broken. They are answering the question they were built to answer — is there malware here? — with complete accuracy. The problem is that it is no longer the question that matters. With autonomous agents in production, the question becomes something none of these tools was ever designed to ask:

Is this AI lying?

That is a different kind of question, and it needs a different kind of answer.

The trick that defeats a single observer

Here is the deeper reason this is hard, and it is worth slowing down for, because it is the whole game.

Any single point of observation can be fooled. This is not a theoretical worry; it is the entire history of computer security. A sufficiently sophisticated rootkit can spoof the operating-system kernel so that everything reading from the kernel — including your endpoint agent — is told, with total confidence, that all is well. The watcher reports normal because the thing it is watching has rewritten what normal looks like. You cannot trust an observer that lives inside the system it is observing, because the system can corrupt the observer.

So you do not rely on one. You watch the same activity from several independent vantage points at once — and you stop looking for the threat directly. You look for something far harder to fake:

Detection is not about seeing the threat. It is about seeing the disagreement between layers.

A rootkit can fool the kernel. What it cannot do is fool the kernel and the hypervisor beneath it and the silicon beneath that, all at the same instant, with a single consistent lie. The lower you go, the further beneath the attacker’s reach you get — and the harder it becomes to keep the story straight everywhere at once. When the hardware reports anomalous memory access or instruction patterns while the operating system is serenely reporting calm, that contradiction is the signal. The discrepancy is the detection.

This is what changes the economics. To evade a single observer, you corrupt one thing. To evade a stack of independent observers, you must forge one coherent lie across silicon, hypervisor, kernel, runtime and cloud simultaneously — and because the lower layers sit below the level you control, you cannot. Cross-layer discrepancy is physically unforgeable, not merely computationally expensive. It is the difference between a lock that is hard to pick and a wall that cannot be in two places at once.

Five layers, watching independently

That is the architecture behind Silo — five independent trust boundaries, from the hardware up, each observing the same agents and none of them dependent on the layer above to tell it the truth:

• L0 · Silicon — ground-truth hardware visibility, below anything software can quietly switch off.
• L1 · Hypervisor — isolation and observation enforced independently of the operating system’s state.
• L2 · OS kernel — complete coverage of every syscall, file and network action.
• L3 · Agent runtime — a per-agent behavioural baseline that catches intent, not just signatures.
• L4 · Cloud — cross-layer signal fusion and graduated, human-gated response.

Compromise has to defeat all five at once. That is the whole idea: not a higher wall, but five walls that have to agree, watched by something that treats their disagreement as the alarm.

Why the incumbents can’t just ship this next quarter

The obvious objection is that one of the giants will simply add it. They will try — and the market will be better for it — but the structural reason it is hard is the same reason it matters.

This is not a feature you bolt onto a malware-era product. It is a ground-up redesign that reaches down through the kernel and the hypervisor to the hardware. That is years of deep-systems work; CrowdStrike spent roughly five years just on its kernel driver. And the platform-monopoly fear — what if Microsoft or AWS gives it away free? — has a clear historical answer. Microsoft built Defender, and CrowdStrike still became a $75B company. AWS shipped GuardDuty, and Wiz still raised at a $12B valuation. Platform features tend to grow a market rather than close it, because CISOs want independent, best-of-breed verification — not a vendor grading its own homework.

There is no Gartner quadrant for AI-agent security yet, because the category is only now being created. The market goes from roughly nothing today to an estimated $2–4B by 2029 as agents move into production everywhere. The first mover does not win a slice of that. It defines the shape of it.

The thread this sits on

I have written a lot lately about systems that fail because they engineer away their own ability to be told the truth — the boardroom with no dissent, the strongman with no honest advisor, the process that removes every mechanism by which someone could say no, not this. A single observer that can be corrupted by the thing it observes is exactly that failure, rendered in silicon. It is a watcher that can be made to lie, guarding a system we have to trust.

The answer is the same at every scale. You do not find a watcher you can trust absolutely; there is no such thing. You build independent vantage points whose disagreement you can trust — because the one thing a compromised system cannot do is keep the same lie consistent everywhere at once.

We are about to hand enormous autonomy to software that operates with perfect credentials. The only safe way to do that is to assume any one view of it can be faked, and to watch from enough independent angles that the truth has nowhere left to hide.

Stop asking whether your AI is running malware.

Start asking whether it is lying — and build the thing that can tell.