Agentic AI and Sensitive Location Data: What the GPT-6 Astra Running-Route Demo Teaches Defenders About Prompt-Borne PII Exposure

---
title: Consumer AI Service Connection from Server Infrastructure
id: 3f8a2b71-9c4d-4e61-a752-8d1c6f0b2a47
status: experimental
description: Detects network connections from server operating systems to consumer LLM/AI service endpoints. Servers have no legitimate business reason to initiate sessions to consumer AI chat or agent APIs; this indicates shadow AI tooling, an unauthorized agent installation, or data staging for exfiltration via an AI service.
references:
  - https://attack.mitre.org/techniques/T1567/002
  - https://simonwillison.net/2026/Sep/12/astra-running-routes/
author: Security Arsenal
date: 2026/09/12
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_server:
    Image|endswith:
      - '\svchost.exe'
      - '\sqlservr.exe'
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\java.exe'
      - '\node.exe'
      - '\python.exe'
  selection_ai_dest:
    DestinationHostname|contains:
      - 'chatgpt.com'
      - 'chat.openai.com'
      - 'claude.ai'
      - 'gemini.google.com'
      - 'copilot.microsoft.com'
      - 'perplexity.ai'
  condition: selection_server and selection_ai_dest
falsepositives:
  - Approved AI integration workloads documented in the CMDB (tune by hostname exclusion)
level: high
---
title: AI Agent or Headless Browser Fetch of External Mapping and Tile Data
id: 6c1e9d04-2b7f-4a38-b965-4f2a8e1d7c93
status: experimental
description: Detects non-browser processes establishing connections to OpenStreetMap tile/Nominatim endpoints, consistent with an autonomous AI agent or script fetching geospatial data. Legitimate mapping lookups originate from browsers or sanctioned GIS tooling; automation runtimes fetching map data warrant review for unsanctioned agent activity and location-data handling.
references:
  - https://attack.mitre.org/techniques/T1105
  - https://attack.mitre.org/techniques/T1059/006
author: Security Arsenal
date: 2026/09/12
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'tile.openstreetmap.org'
      - 'nominatim.openstreetmap.org'
      - 'overpass-api.de'
  selection_proc:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_dest and selection_proc
falsepositives:
  - Sanctioned GIS, logistics, or fleet-management tooling
  - Developer environments with documented OSM integrations
level: medium

// Hunt: Large or sustained outbound transfers to consumer AI service domains
// Purpose: identify potential PII/prompt-data leakage and shadow AI usage patterns.
// Tune the byte threshold to your environment; look for users/devices, not single hits.
let AIDomains = dynamic([
  "chatgpt.com", "chat.openai.com", "api.openai.com",
  "claude.ai", "api.anthropic.com", "gemini.google.com",
  "copilot.microsoft.com", "perplexity.ai", "grok.x.ai"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (AIDomains)
| summarize Connections = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            InitiatingProcesses = make_set(InitiatingProcessFileName, 10)
  by DeviceName, InitiatingProcessAccountName, RemoteUrl
| where Connections > 200  // sustained usage pattern, not incidental browsing
| project DeviceName, InitiatingProcessAccountName, RemoteUrl,
          Connections, InitiatingProcesses, FirstSeen, LastSeen
| order by Connections desc;

// Hunt: Executable/script processes fetching open geospatial data (agent-like behavior)
// Requires Syslog/CEF ingestion for Linux or Defender process+network correlation.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (
    "nominatim.openstreetmap.org", "overpass-api.de", "tile.openstreetmap.org")
   or (ProcessCommandLine has_any ("gpx", "geojson")
       and ProcessCommandLine has_any ("curl", "wget", "requests", "fetch"))
| project TimeGenerated, DeviceName, AccountName,
          FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

-- Hunt: AI agent/desktop clients and automation runtimes with live connections
-- to AI service endpoints, plus recently written geospatial export artifacts (GPX/GeoJSON).
-- Deploy as a Velociraptor hunt across the workstation fleet.
SELECT Pid, Name, Exe, Username, CommandLine
FROM pslist()
WHERE Name =~ '(?i)(chatgpt|copilot|claude|perplexity|openai)'
   OR CommandLine =~ '(?i)(api\.openai\.com|api\.anthropic\.com|chatgpt\.com)'

-- Correlate with recent geospatial artifact drops in user-writable locations
SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/Downloads/*.gpx',
  'C:/Users/*/Downloads/*.geojson',
  'C:/Users/*/Desktop/*.gpx',
  'C:/Users/*/OneDrive*/**/*.gpx'
])
WHERE Mtime > (now() - 604800)  -- last 7 days

# Shadow-AI egress audit and hardening for Windows fleets
# 1) Audit outbound connections to consumer AI domains via DNS query logs / firewall
$AIDomains = @('chatgpt.com','chat.openai.com','claude.ai','gemini.google.com','perplexity.ai','copilot.microsoft.com')

# Review DNS client cache for evidence of AI endpoint resolution (run elevated, fleet-wide via GPO/Intune or EDR)
Get-DnsClientCache | Where-Object {
    $name = $_.Entry; $AIDomains | Where-Object { $name -like "*$_*" }
} | Select-Object Entry, Data, TimeToLive | Export-Csv -Path "$env:TEMP\shadow_ai_dns_audit.csv" -NoTypeInformation

# 2) Verify your proxy/CASB category block is effective: these should FAIL where policy blocks consumer AI
foreach ($d in $AIDomains) {
    try {
        $r = Invoke-WebRequest -Uri "https://$d" -Method Head -TimeoutSec 5 -UseBasicParsing
        Write-Output "[WARN] Reachable (policy gap): $d -> HTTP $($r.StatusCode)"
    } catch {
        Write-Output "[OK] Blocked or unreachable per policy: $d"
    }
}

# 3) Enumerate recently created geospatial artifacts that may anchor on employee home locations
Get-ChildItem -Path "C:\Users" -Recurse -Include *.gpx,*.geojson -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, Length, LastWriteTime | Export-Csv -Path "$env:TEMP\geospatial_artifacts.csv" -NoTypeInformation

Write-Output "Review outputs in $env:TEMP and escalate findings per your shadow-AI IR playbook."