/
← Voltar ao feed
low technology software development

SafeDep tests Jev and Gryph to flag malicious actions by compromised AI coding agents such as Claude Code

1 fonte(s) · 1 atualização(ões) · publicado 24/09/2026 21:00 · coletado há 1 dia

A SafeDep researcher describes an experiment that uses Gryph (an audit trail for AI coding agents) and TypeSafe AI's Jev model to separate a developer's normal agent activity from attacks. The article cites threats to agents such as Claude Code and Codex: the Mini Shai-Hulud worm commits Claude Code hooks into repositories, malicious npm packages plant SessionStart hooks, and in July 2026 Hacktron researchers took over an employee's connected Codex session on OpenAI's community forum via an image decoder bug. In testing, the engine flagged all 14 synthetic attacks and let 5,225 of 5,398 real events from two developers pass, at a total cost of $0.81. The author judges it good enough for a prototype but not yet for an organization, because about 3.2% of events were flagged.

Technical Details

  • Gryph hooks into agents (Claude Code, Codex, Cursor, Gemini CLI, Windsurf and others) and stores one JSON event per action, with types such as command_exec, file_read, file_write and tool_use.
  • Each event is sent to Jev (jev-1.13.0) with an LLM-written developer profile of about 50 lines, org policies P1 to P6, and the previous 15 session events. Jev answers atomic yes/no questions (one noul question per policy) with a probability for each.
  • Thresholds: alert at 0.8 or higher, review at 0.5 or higher. One test attack, a curl upload of ~/.npmrc to a paste site, scored 0.96 on data_exfiltration, 0.93 on policy_P3 and 0.82 on secret_access.
  • All 14 synthetic attacks (SSH key read, npm token upload, .bashrc backdoor, prompt injection and others) scored 0.87 or higher. Five of six synthetic safe events passed.
  • Most flags on real work came from package installs (npx -y, npm install), LLM evaluation scripts that load API keys, posts to other organizations' repositories, and edits to hooks in Claude Code settings.json.
  • Stated limitations: the prototype checks one event at a time, so attacks spread over a long session may look harmless at each step. The thresholds are guesses. An attacker who writes text aimed at Jev may still try to change its answers. The sample policies also flagged skills and web search by mistake.

Remediation

  • Keep org policies aligned with current guidance for AI coding agents.
  • Keep developer profiles current with recent work patterns.
  • Set thresholds per question from reviewed alerts.
  • Have a reviewer check each flagged event. Approved events feed the next profile, and rejected events go to triage and never into the profile.
  • Add a session-level check and test prompt-injection resistance further.

Linha do tempo

  1. safedep.io ↗ · pub. 24/09/2026 21:00 · coletado 19/10 18:03 primeiro registro

    SafeDep tests Jev and Gryph to flag malicious actions by compromised AI coding agents such as Claude Code

    ler a análise desta fonte

    A SafeDep researcher describes an experiment that uses Gryph (an audit trail for AI coding agents) and TypeSafe AI's Jev model to separate a developer's normal agent activity from attacks. The article cites threats to agents such as Claude Code and Codex: the Mini Shai-Hulud worm commits Claude Code hooks into repositories, malicious npm packages plant SessionStart hooks, and in July 2026 Hacktron researchers took over an employee's connected Codex session on OpenAI's community forum via an image decoder bug. In testing, the engine flagged all 14 synthetic attacks and let 5,225 of 5,398 real events from two developers pass, at a total cost of $0.81. The author judges it good enough for a prototype but not yet for an organization, because about 3.2% of events were flagged.

    Technical Details

    • Gryph hooks into agents (Claude Code, Codex, Cursor, Gemini CLI, Windsurf and others) and stores one JSON event per action, with types such as command_exec, file_read, file_write and tool_use.
    • Each event is sent to Jev (jev-1.13.0) with an LLM-written developer profile of about 50 lines, org policies P1 to P6, and the previous 15 session events. Jev answers atomic yes/no questions (one noul question per policy) with a probability for each.
    • Thresholds: alert at 0.8 or higher, review at 0.5 or higher. One test attack, a curl upload of ~/.npmrc to a paste site, scored 0.96 on data_exfiltration, 0.93 on policy_P3 and 0.82 on secret_access.
    • All 14 synthetic attacks (SSH key read, npm token upload, .bashrc backdoor, prompt injection and others) scored 0.87 or higher. Five of six synthetic safe events passed.
    • Most flags on real work came from package installs (npx -y, npm install), LLM evaluation scripts that load API keys, posts to other organizations' repositories, and edits to hooks in Claude Code settings.json.
    • Stated limitations: the prototype checks one event at a time, so attacks spread over a long session may look harmless at each step. The thresholds are guesses. An attacker who writes text aimed at Jev may still try to change its answers. The sample policies also flagged skills and web search by mistake.

    Remediation

    • Keep org policies aligned with current guidance for AI coding agents.
    • Keep developer profiles current with recent work patterns.
    • Set thresholds per question from reviewed alerts.
    • Have a reviewer check each flagged event. Approved events feed the next profile, and rejected events go to triage and never into the profile.
    • Add a session-level check and test prompt-injection resistance further.