AgentDrift shows AI detects drift, but normal must be human-owned

The piece opens with a policy shift: on October 1, 2026, the main parts of Japan's active cyber defense framework took effect, moving defense from passive to active — detect and stop before spread. That backdrop matters because detection volume rises and attackers have also gotten cheaper and faster with AI, which is why leaning on AI for detection looks natural. The analysis insists the order is what matters, not the tools.

The research it surveys did not appear in a vacuum. Policies on Paths (arXiv:2603.16586) sets the premise that agents are non-deterministic and execution-path dependent, so static access control is only a special case that ignores the path — runtime evaluation is the general form. From that starting point, the 2026 papers split along two axes: step-level judgments give way to trajectory-level ones, and the center of gravity drops from the application layer to the kernel. AgentDrift quantified the first axis by showing that step-level features caught only 55.4% overall; Agent-Warden and ACE pushed the second axis down to eBPF process-file provenance and paired syscall traces.

What the surveyed papers share, per the analysis, is that all of their accuracy figures are snapshot evaluations against the 'normal' learned at training time — not weeks or months into operation. The piece ties this to two failure modes: a frozen boundary floods operators with false positives until they stop reading alerts, while casual retraining lets an attacker's slow erosion dissolve into the baseline. Self-State Attacks (arXiv:2607.17986) is cited as hitting the same wall from another angle, arguing the limit lies in decision context rather than OS observability, and that coverage and selectivity cannot both be had. On top of that, the detector is itself an attack surface: Evasive Injections reports 93.91% and 99.63% simultaneous bypass on smaller models, and DoS on Guardrails reports latency amplified up to 148× with a single poisoned document saturating a shared guardrail foundation, so trusting one detector or one shared layer is a single point of failure.