When telemetry becomes an instruction

Logs are evidence until an automated operator can act on them. Then they are also an input—and potentially an attack surface.

That is the useful lesson from research presented at USENIX Security 2026. The authors studied AI for IT operations systems in which language-model agents inspect telemetry, diagnose incidents, and recommend or execute remediation. In their test environments, an external attacker could influence application telemetry and steer an agent toward an unsafe fix.

The finding does not make logs less valuable. It changes the trust we place in them.

What the researchers found

The team evaluated two agent designs across three synthetic microservice applications in AIOpsLab. The attacker did not need privileged access to the observability stack. Instead, ordinary interactions with public application interfaces produced errors containing attacker-controlled values. Those values then appeared in logs, traces, or other telemetry the agent used during diagnosis.

The researchers shaped that telemetry to present a plausible but false explanation for an incident and an unsafe remediation. Across 180 trials, they report that the tested agents selected the intended unsafe remediation 90% of the time on average. The examples included weakening configuration, adding an untrusted package source, or downgrading software to a vulnerable version.

This was a controlled study, not an assessment of every commercial AIOps product. Its results depend on the applications, agent designs, models, telemetry paths, and authority configured in the test bed. The paper first appeared as a preprint in August 2025; its appearance in the USENIX Security 2026 proceedings is the current reason to revisit it.

The subtle boundary between data and direction

Security teams already know that logs can contain hostile strings. The more important issue is what happens after those strings reach a system that interprets their meaning and can act on the interpretation.

A traditional monitoring pipeline may display a malformed request for a human to inspect. An AI operations agent can connect the same request to a diagnosis, combine it with legitimate system detail, and turn the result into a convincing course of action. The telemetry has not formally granted permission, but it has influenced the component choosing how permission will be used.

That makes provenance operationally important. A timestamp generated by the platform, a service name supplied by configuration, and a URL or error value influenced by an outside user should not arrive with the same implied trust simply because they share one log record.

What operators should examine now

First, map which telemetry fields can contain externally influenced content. Trace those fields all the way from public endpoints and APIs to alerts, retrieval layers, agent context, tickets, and remediation workflows. A field does not become trusted because an observability tool collected it.

Second, preserve provenance when telemetry is transformed. Structured schemas, field-level labels, allowlists, and sanitization can keep attacker-controlled text from masquerading as operational guidance. The paper's proposed defense, AIOpsShield, identifies fields that can be influenced externally and abstracts them before telemetry reaches the agent. In the authors' rerun of the evaluated attacks, none succeeded. They also acknowledge important limits: incomplete templates, unstructured telemetry, poisoned inputs outside telemetry, and supply-chain attacks remain separate problems.

Third, separate diagnosis from execution. An agent that can recommend a change does not automatically need permission to make it. Bound credentials, action-specific approval, destination and command restrictions, and a clear maximum effect reduce the consequence of a bad interpretation.

Finally, test the entire path. Evaluation should include externally influenced telemetry, misleading but plausible root causes, unsafe remediation proposals, and attempts to cross the intended authority boundary. Retain enough evidence to show which input influenced the diagnosis, which action was proposed, who or what approved it, and what changed.

The PrivacyFirst view

Telemetry should be treated as evidence with provenance, not truth with authority.

The closer an AI system moves to operational control, the more important it becomes to keep observation, interpretation, approval, and execution as distinct boundaries. The goal is not an agent that trusts everything it can see. It is an operational design that knows where its evidence came from—and limits what any one interpretation can change.