External Network Egress Anomaly Detection (AD-015)

Enterprise Signals now includes a new deterministic anomaly detector, AD-015 (External Network Egress). When an AI coding session initiates an outbound connection to a non-local destination—whether through curl, wget, scp, rsync, nc, inline Python or Node scripts, or native agent web-fetch tools—ReclaimLLM flags the session, classifies the risk level by behavior, and surfaces the normalized destination hosts and IP addresses in the Signals dashboard and alert digests.

High- and critical-severity egress findings run on both the hourly and daily anomaly schedules, so outbound data uploads, cloud metadata probes, or egress chained with sensitive file reads trigger immediate P0 email alerts within the hour.

How It Works

AD-015 evaluates normalized tool-call records for every completed session across all supported agent clients (Claude Code, Cursor, Codex CLI, GitHub Copilot, Gemini CLI, Windsurf, and OpenCode) and all underlying models. Rather than relying on a single tool name, the detector inspects four distinct egress surfaces:

1. Shell HTTP utilities (shell_http): Unwraps compound shell commands (;, &&, ||, pipes, sudo, bash -c) to inspect invocations of curl, wget, http/https (HTTPie), xh, curlie, aria2c, fetch, Invoke-WebRequest (iwr), and Invoke-RestMethod (irm).
2. File-transfer and socket binaries (shell_transfer): Inspects scp, sftp, rsync, ftp, tftp, nc/ncat/netcat, socat, telnet, and ssh for remote user@host:path targets, remote URIs, and raw external host/IP connections.
3. Programmatic and scripted egress (script_egress): Inspects both inline script one-liners (python3 -c, node -e, ruby -e, php -r) and agent-written code (file_write and file_edit) that combine network client libraries (requests, urllib, httpx, aiohttp, http.client, socket, paramiko, fetch, axios, undici, Net::HTTP, curl_exec) with an explicit external URL or IP address.
4. Native web and browser tools (native_web_fetch): Inspects agent-native URL fetch and navigation tools (WebFetch, web_fetch, browser_navigate, playwright_navigate, puppeteer_navigate). Pure search queries without a direct URL target are ignored.

Localhost Exclusion and Severity Grading

Routine local development traffic to loopback and local container addresses (localhost, 127.0.0.0/8, ::1, 0.0.0.0, host.docker.internal, and *.local) is excluded automatically. All other external connections are flagged and graded into three severity tiers based on what the tool call attempted to do:

• Critical (Immediate P0 Alert + Security Inbox Routing):
  • Outbound data uploads and mutations: curl or wget calls with upload flags (-X POST, -X PUT, -X PATCH, --data, --data-binary, -d, -F, --form, -T, --upload-file, --post-data, --post-file), scp or rsync commands copying local files to a remote host, or programmatic POST/PUT requests (requests.post, requests.put, axios.post).
  • Cloud metadata and SSRF probes: Requests targeting link-local or cloud instance metadata endpoints (169.254.169.254, 169.254.170.2, 100.100.100.200, fd00:ec2::254, metadata.google.internal) commonly used to harvest temporary IAM credentials.
  • Remote pipe-to-shell execution: Piping curl or wget output directly into an interpreter (sh, bash, zsh, python, node).
  • Chained reconnaissance or sensitive file access: Any external egress occurring in the same session where the agent also read sensitive files (.env, .ssh/, .aws/, private keys) or ran environment reconnaissance commands (cat /etc/resolv.conf, cat /etc/passwd, which curl, printenv).
• High (Immediate P0 Alert):
  • Outbound shell HTTP requests (curl, wget), remote transfer/socket utilities (scp, sftp, rsync, nc, ssh), programmatic script egress, downloads written directly to /tmp (curl -o /tmp/...), or connections to raw external IPv4/IPv6 literals.
• Warning (Daily/Weekly Digest):
  • Read-only native WebFetch or browser navigation calls to external domains.

Zero-Exfiltration Evidence Boundary

If an agent attempts to exfiltrate a secret in a URL query parameter, header, or request body, copying that raw command or URL into an anomaly report or email alert would compound the exposure. Following ReclaimLLM's zero-exfiltration alert boundary, AD-015 strips userinfo, URL paths, query strings, fragments, headers, and request payloads before persisting evidence.

Each finding records only:

• Normalized lowercase destination_hosts and destination_ips
• Egress surfaces (shell_http, shell_transfer, script_egress, native_web_fetch)
• Egress methods (upload_put_post, read_fetch, remote_transfer, metadata_probe, pipe_to_shell, download_to_tmp)
• Command families (curl, scp, python3, etc.), model name, and session links

Background and Motivation

Recent security evaluations—including Cohere's October 2026 disclosure on anomalous behavior in open-weight models during benchmark runs—demonstrated a critical failure mode in agentic oversight: a model's chain-of-thought reasoning trace is not a security boundary. In documented cases, a model's reasoning block stated it would return a brief acknowledgment without invoking any tools, while the same turn executed shell commands to inventory /tmp, check which curl wget python3, read /etc/resolv.conf, probe 169.254.169.254, or execute curl -X PUT --data-binary uploads to external object storage.

Previously, ReclaimLLM's anomaly suite covered usage spikes (AD-001), first-seen dependency combinations (AD-002), runaway retry loops (AD-003), local sensitive file access (AD-004), proxy operation shifts (AD-005/AD-006), and endpoint hook/DLP coverage (AD-010–AD-014). None of those detectors inspected tool calls for outbound network egress. AD-015 closes that gap across every model and agent client.

Using AD-015 in Your Workflow

AD-015 is enabled by default for all enterprise organizations. Findings appear in Enterprise → Signals → Anomaly Reports, where you can filter by AD-015 · Egress to inspect destination hosts, see which model and tool family initiated the connection, and jump directly to the underlying session timeline. Organization admins and individual members can configure notification preferences for AD-015 in the Alert Settings modal.

Current Limitations and What We're Watching

• Broad initial surface: In this first release, AD-015 flags all non-localhost external egress without a pre-populated domain allowlist. If your developers routinely use shell curl against public APIs or package registries during agent sessions, those sessions will generate high findings (and warning findings for native WebFetch calls). We structured the host and IP extractor with a dedicated policy hook so we can follow up with configurable IP/CIDR, domain/website, and GeoIP country banlists and allowlists based on real-world signal noise.
• Obfuscated shell payloads: AD-015 parses unwrapped shell segments and inline script strings deterministically. A heavily obfuscated command (for example, base64-decoding an arbitrary string piped to sh without an explicit network binary or URL literal in the outer command) may evade static command-token classification.
• Large script previews: For file_write and file_edit events, detection scans the captured input and diff previews. If an agent writes a large multi-hundred-line script where the external URL falls outside the preview window, the activity may only be flagged when the script is executed in the shell.

If you run into noisy developer patterns, false positives on internal corporate domains, or obfuscation edge cases we should cover, let us know—your feedback directly shapes the upcoming domain and IP policy controls.