Definition
Plain language
The distance between what an action looks like on a computer and what it actually means.
As stated in the literature
The mismatch between syscall- or network-level visibility of agent actions and their intent or business meaning, which renders signature-based defenses blind to context-dependent agent misbehavior.
Why it matters: Until monitoring tools understand intent rather than just syscalls, defenders will keep getting blindsided by agents that misbehave through entirely legal-looking actions.
For example, an agent making a sequence of perfectly normal file reads looks innocent at the system-call level, even though it's quietly exfiltrating sensitive data.
Heard on the show
“They call it the semantic gap.”Episode 057 — How Uber Caught 206 Leaked Credentials With an LLM-Powered Security Stack