When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection

Summary

Classic intrusion detection signatures suffer from an exposure window between zero-day discovery and rule distribution, leaving slight exploit variations unflagged. Cisco Talos addressed this by embedding SnortML into Snort 3 to perform local, sub-millisecond machine learning inference alongside signature checks. SnortML employs an LSTM preceded by a byte-embedding layer and XNNPACK acceleration to score URI queries and POST bodies for vulnerabilities like SQL injection, XSS, and command injection. Running both detection mechanisms concurrently provides independent error profiles and boosts detection confidence when both fire. The broader defense landscape is shifting toward connecting these packet-level ML detectors with agentic AI pipelines and supervised feedback loops.

Context

Classic signature-based IDS deployments leave an exposure gap during the days or weeks required to capture, reverse-engineer, write, test, and ship rules for novel exploit variants.

Approach / What changed

Cisco Talos implemented SnortML natively inside Snort 3, using an embedded LSTM neural network with XNNPACK hardware acceleration to classify raw request bytes in parallel with traditional signature evaluation.

Takeaways

• SnortML executes local inference in approximately 350 microseconds on a 4.7 GHz AMD processor without relying on cloud reputation calls.
• From Secure Firewall 10.0.0 onward, SnortML automatically selects between models calibrated for 256, 512, or 1024-byte input distributions based on query length.
• Parallel execution allows ML to catch novel payload variations while traditional signatures maintain a low false-positive baseline for known threats.

Related reading

• Stack Overflow · Jun 23, 2026

  Your AI shipped a backend that boots. That is the whole problem.

  Backend security vulnerabilities often emerge from permissive default settings in web frameworks, a risk amplified when AI agents generate code focused solely on passing tests. Common failure points include unmetered request body parsing, unvalidated schemas, prototype pollution, and wildcard cross-origin resource sharing policies. To eliminate these foot-guns, the TypeScript framework DaloyJS enforces secure-by-default behavior across its entire routing and middleware model. It provides built-in request timeouts, streamed body size caps, prototype-stripping JSON revivers, and unified Zod schemas that simultaneously validate payloads and generate OpenAPI contracts. While secure defaults lower the risk of common infrastructure exploits, developers still remain responsible for application-level authorization and business logic correctness.

  Devlin Duldulao

• Stack Overflow · Jul 24, 2026