I'm curious to know if an attacker can fundamentally exploit the debugging process.

I'm not asking if specific debugging tools have been exploitable, surely some have, but rather whether the process of debugging - any and perhaps every debugging tool - is vulnerable to being lied to or used as an attack surface.

This relates to research I'm doing on the problem space of modern malware using polymorphism, emulator evasion, and obfuscation to defeat signature recognition.

It doesn't matter if the attacker knows it's running in a debugger

I'm fully aware that an attacker can detect they're running in a debugger and use evasion strategies to hide the malicious behavior they might otherwise demonstrate on a target machine. However, I'm interested in the usage of a debugger to track the state of a process on the target machine so I can experiment with applying machine learning to develop signatures of polymorphic, obfuscated, and evasive programs. Because we're watching a process on the actual target rather than within an EV emulator sandbox, it doesn't matter that the attacker knows they're being watched by a debugger.

The attacker has to execute the malicious behavior path within their code in order for the payload to accomplish its goal.

Performance isn't of interest

I realize running a program in a debugger will cause a significant performance hit. That's an accepted trade-off of the research I'm interested in. We're assuming the defender is willing to pay higher hardware costs to run programs, and if certain computational expensive programs can't afford this overhead, the security measure couldn't apply to certain hosts running those processes and may be isolated in a specific network segment with that fact in mind.

My question is this:

Is there a fundamental flaw in the reliability of the way debugging can be accomplished? Is the way debugging happens vulnerable at the processor, kernel, or OS level? Is it possible for a properly designed debugger to reliably watch the state of a program in a production environment as it executes?