{
  "id": 8748959,
  "title": "Your Antivirus Only Watches. Mine Kills: Building a Detect-and-Respond Agent in Rust + eBPF",
  "url": "https://urgent.news/2026/09/20/your-antivirus-only-watches-mine-kills-building-a-detect-and-respond",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-20T18:50:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bartoszosiej/your-antivirus-only-watches-mine-kills-building-a-detect-and-respond-agent-in-rust-ebpf-20do"
  },
  "original_language": "en",
  "account": "The ransomware threat requires an antivirus that takes action, not just detects and alerts. The Talus project, MIT-licensed and open source, delivers just that. It uses Rust and eBPF to build a \"detect-and-respond\" agent that watches kernel-level events, scores file opens in real-time, and kills ransomware processes before they can encrypt files. Talus achieves high performance by staying in the kernel for syscall hooking, using per-CPU buffers to avoid lock contention, and employing zero-copy handoffs to userspace for minimal copying. The architecture separates kernel watching, userspace detection, and response, allowing the system to handle up to 280,000 events per second on approximately 7.6% CPU on a live desktop. The project is flexible, allowing users to adjust thresholds for watching or auto-killing, and is documented in detail in its GitHub repository and landing page.",
  "summary": "Most ransomware \"solutions\" stop at detection: an alert, a dashboard row, an email you'll read tomorrow. By then the attacker has already encrypted the shares. I wanted the other thing: the process dies the moment the verdict fires. This post is about how Talus does that in Rust, with eBPF doing the watching and a response layer doing the killing — and what it took to keep the whole pipeline at…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}