The hidden agent surface — Qpoint Design

The article is still being written. Its argument is settled enough to design against; its wording and figures may change.

In plain words

Most people watching an AI helper only watch the moments it asks for something: "can I open this?", "can I run that?". But the helper can also build its own little machines and switch them on. Once a machine is running, nobody watching the helper is watching the machine. The machine can open the key drawer and mail the keys out the window, and all anyone saw was "the helper switched something on." The hidden surface is everything those machines do. Qpoint treats the helper and every machine it starts as one person, so when the keys go out the window, the record says who did it.

The article in three lines

Agent security mostly stops at the tool call, but the tool call ends when the command starts: whatever the scripts it writes, its sub-agents and its MCP servers over stdio do after that is the hidden agent surface, where most of an agent's real work happens. Every layer sees a slice (the harness sees a Bash call, EDR sees python3 open a file, the network sees an HTTPS connection from the laptop) and none ties them back to the agent, the session and the person. Qpoint treats an agent and every process it starts as one unit, so a README with hidden instructions, a script written on one turn and run on the next, and ~/.aws/credentials posted to an outside host show up as one attributed audit log, ready for a SIEM rule, agent-tagged network rules, or a plugin that blocks the read before it completes.

The line that wants to be the picture: "Tool calls are only part of what an agent does. The rest happens in the code the agent writes and executes."

Second of three in the series (after Your agents need a dynamic sandbox, which the article links, before Treat your agents like insiders, which its closing paragraph announces). "Hidden surface" invites an iceberg; that is the obvious read.

The author's figures in the folder: hidden_surface_grid (the layers-see-a-slice idea, placed after the README story) and an audit-log screenshot pair, light and dark (placed under "The audit log is the proof"). The hero should not redraw the grid or the log.

Jargon

Term	What it means here	If you had to draw it
Agent	An AI program that takes a goal and works through it on its own. Here, a coding assistant on a laptop.	The helper
Harness	The app the agent runs inside (Claude Code, Codex, Cursor). Has hooks and permission settings of its own.	The helper's uniform
Tool call	One request the agent makes through the harness. The visible part.	A hand reaching for a drawer
Hidden surface	Everything the agent does through programs it starts, rather than through its own tool calls. The article's subject.	The part of the figure below the waterline (an obvious read; name it, then go past it)
Script	Code the agent writes and then runs as a separate program.	A little machine the helper built
Sub-agent	An agent started by another agent, which starts its own programs in turn.	A smaller helper the helper hired
MCP server (over stdio)	A helper program that gives the agent extra abilities (search, databases). "Over stdio" means it runs as a child program on the same machine, with its own access.	A toolbox that is also alive
Process, child process	A running program; a child is one started by another.	A figure with figures behind it
Harness hooks and permissions	Rules inside the harness. They see "run this command" but not what the command does.	A doorman who checks the name, not the bag
EDR	Endpoint detection and response: security software on laptops that watches running programs. Sees a process tree, not that it came from an agent.	A guard who sees shapes, not faces
SIEM	The central place a security team collects logs and sets alerts.	A control room
Network controls, AI gateway	Tools watching traffic leaving the machine. See a connection, not who made it.	A guard at the gate
Credentials, `~/.aws/credentials`	A file holding keys to a cloud account. The thing that gets stolen in the story.	A key ring
README with hidden instructions	A documentation file that secretly contains commands to the AI ("prompt injection"). The agent reads it and obeys.	A note slipped into a book
Exfiltration, "posts to an external host"	Sending data off the machine to somewhere outside.	Keys going out the window
Audit log	The chronological record of everything the agent and its children did, each row tagged with agent, session, user, host.	A ledger
Session	One run of the agent, from the user's request to the end.	One shift
Attribution	Tying an action back to which agent, session, and person caused it. The thing every other layer lacks.	A name tag on every action
Qpoint runtime	The part of Qpoint on the machine that monitors an agent and every process under it.	A stethoscope
Process lineage	The chain of which program started which, kept so a nested action still traces back to the agent.	A family tree
Model requests	The agent's calls to its AI provider (here `api.anthropic.com`), logged in order with everything else it did.	The helper phoning head office
Detection rule	A SIEM alert written once, such as "an agent reads a credential file, then connects to an unexpected host".	A tripwire
Plugin	A small separate program that sees each event and can block a file read or request before it completes.	A hand closing the drawer

Record

Article final (2026-10-21): ready to publish. Headings: Where the hidden surface comes from · Why every layer misses it · From a README to stolen credentials · How Qpoint sees the hidden surface · The audit log is the proof · Putting the hidden surface to work. Ends on a demo link.
Hero and listing (2026-10-20): hero.png (with hero.svg) and listing.png in the folder's AI images subfolder, already placed at the top of the article doc. They came in outside the Direction → Ideation → Review steps.
Shipped: