RS-2026-092 The Data Layer is the Blind Spot: Empirical Bypasses of Kernel-Level Runtime Enforcement

Kernel-level enforcement mechanisms — BPF LSM, eBPF, in-memory attestation — are the current state of the art for securing high-assurance AI workloads. The core assumption of these systems is that if you verify the binary and enforce the syscall, the execution is secure. This paper presents empirical evidence that this assumption is structurally flawed.We demonstrate three distinct attack classes — memory poisoning, knowledge-base poisoning, and hallucination-based supply-chain injection — that operate entirely through legitimate, authorized syscalls. In every case, the enforcement layer observes a signed, verified binary performing its normal function. The attack is in the data the binary processes, not the execution path it takes. This finding establishes a hard boundary between execution-layer controls and data-layer truth, and argues that any durable enforcement mechanism must bind intent to an out-of-band root of trust rather than relying on the integrity of the data the agent reasons over.All findings are reproducible. Each attack class is accompanied by a cryptographically signed evidence chain (Ed25519 + ML-DSA-65, SHA-256 Merkle tree) produced by the SPECTER HALLUBOT, SPECTER SHELL, and SPECTER EMBEDDED toolchain. Chain integrity was verified in each case.