Detecting Threats in the AI Stack
AI adoption is outrunning AI visibility. Coding agents now run with deep system access on the endpoint, models and agents are standing up in the cloud, and almost no detection content exists for either. Attackers have noticed. LLMjacking burns six figures on stolen keys, and agent-trust flaws like TrustFall turn one click into code execution.
Justin Borland, Director of Threat Engineering at Abstract, walks through detection engineering for both ends of the AI stack: where the telemetry lives across Claude Code/Cowork, CloudTrail, and CloudWatch, what to keep, what to drop, and how to correlate it into high-fidelity alerts. Real detections, real logs, no hand-waving.
