Last week we showed what AI agents look like at the syscall level. This week we ran real malware. We took the Trivy TPCP payload - the same one that hit thousands of CI pipelines on March 19 - on one of our VMs. Here's what the attacker got: three proxy tokens that authenticate to nothing. Our VMs never contain real credentials. Secrets are injected outside the VM. The malware collected opaque strings, encrypted them, and tried to exfiltrate worthless tokens. Meanwhile our eBPF sensor recorded everything. We captured hundreds of events, ranging from environment scans to a dump of Kubernetes secrets. The malware doesn't need to be blocked to be harmless.