Definition
Plain language
The way a running program asks the operating system to do something it can't do on its own, like read a file or open a network connection.
As stated in the literature
A controlled entry point through which user-space code requests a privileged operation from the OS kernel; invoked as the analogy for an agent's tool calls and as the low-level visibility layer that signature-based monitors observe.
Also called: syscall, syscalls, system calls
Why it matters: Because every privileged action funnels through these requests, watching them gives a reliable low-level window into what a program — or an agent — is actually doing.
For example, when a program wants to read a file, it can't touch the disk directly and must ask the operating system to do it on its behalf.
Heard on the show
“Same syscall, opposite meaning.”Episode 057 — How Uber Caught 206 Leaked Credentials With an LLM-Powered Security Stack