Detecting Compromised AI Coding Agents with Jev and Gryph

Summary

SafeDep describes a prototype for detecting compromised AI coding agents by combining Gryph’s event audit trail with TypeSafe AI’s Jev model. Gryph records actions from agents including Claude Code, Codex, Cursor, Gemini CLI and Windsurf in a local database that can also be exported to OpenSearch. Jev evaluates each event against a developer profile, organization policies and the previous 15 events from the same session, answering atomic questions about secret access, data exfiltration, persistence, untrusted execution, prompt injection, policy violations and overall compromise. The developer profile is generated from recent activity and is intended to distinguish unusual behavior from legitimate work by the same person. An event becomes an alert at a risk or policy probability of 0.8 and goes to review at 0.5. In tests using two developers’ data, all 14 synthetic attacks were alerted, while five of six synthetic safe events passed. Among 5,398 real events, 5,225 passed, 146 went to review and 27 became alerts. The main sources of flags were package installation, evaluation scripts that accessed API keys and external services, posts to repositories owned by other organizations, and edits to Claude Code settings hooks. The prototype cost $0.81 for the real-event run, using 19.4 million input tokens and 8 parallel requests over about 12.7 minutes. The authors estimate that 1,000 developers generating 500 events daily would consume about 1.75 billion tokens per day at the listed price, or roughly $75. The article says the prototype is promising but not ready for organizational deployment: the thresholds are provisional, policies need testing, profile coverage is incomplete, and event-by-event analysis may miss attacks spread across a longer session. It proposes reviewer feedback, profile updates and threshold tuning as a way to reduce noise, while identifying session-level analysis and stronger defenses against attempts to manipulate Jev as future work.