AI Agents Escaping Containment: A Defender's Guide to Detecting and Containing Rogue Agentic AI Before the Breach

---
title: AI Agent Runtime Spawning Unexpected Child Processes
id: 3f8c1a92-7d44-4e5b-b9a1-2c6d8e0f4a5b
status: experimental
description: Detects AI agent runtime processes (Python, Node.js) spawning shells, network utilities, or scripting engines, which may indicate an agent escaping its intended task boundary or executing injected instructions.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.darkreading.com/insider-threats/ai-agents-breaches-humans-liable
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_agent_hosts:
    # Tune: exclude known automation/CI hosts where this is expected
    Computer|contains: 'CI-BUILD'
  condition: selection_parent and selection_child and not filter_agent_hosts
falsepositives:
  - Legitimate AI/ML pipelines that shell out to system tools
  - Developer workstations running agent frameworks locally
level: high
---
title: AI Agent Service Account Authenticating to Unsanctioned Resources
id: 8b2e5d17-4c9a-4f68-a3d2-7e1b9c0f6d3a
status: experimental
description: Detects service accounts associated with AI agent workloads performing interactive logons or accessing systems outside their expected scope, indicating possible agent credential misuse after containment deviation.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://www.darkreading.com/insider-threats/ai-agents-breaches-humans-liable
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.initial_access
  - attack.t1078.004
logsource:
  category: authentication
  product: windows
detection:
  selection:
    user|contains:
      - 'svc-aiagent'
      - 'svc-agent'
      - 'svc-copilot'
      - 'svc-llm'
    LogonType:
      - 2
      - 10
  condition: selection
falsepositives:
  - Misconfigured agent services running interactively during initial deployment
  - Administrators troubleshooting under the agent account (should be prohibited by policy)
level: high
---
title: Scripting Runtime Initiating Outbound Connection to Rare External Host
id: c4d7a1f3-2e8b-4b5c-9a6e-1f3d5b7c9e2a
status: experimental
description: Detects Python or Node.js runtimes establishing outbound network connections, a behavioral indicator of an AI agent reaching external systems beyond its sanctioned API endpoints.
references:
  - https://attack.mitre.org/techniques/T1071.001/
  - https://www.darkreading.com/insider-threats/ai-agents-breaches-humans-liable
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
    Initiated: 'true'
  filter_sanctioned:
    # Tune: populate with your approved AI API endpoints (e.g., api.openai.com, your internal gateways)
    DestinationHostname|endswith:
      - '.openai.com'
      - '.azure.com'
      - '.anthropic.com'
      - '.googleapis.com'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter_sanctioned and not filter_internal
falsepositives:
  - Package managers (pip, npm) fetching dependencies — consider filtering on destination ports 443 to known CDNs
  - Legitimate research tooling
level: medium

// Hunt: AI agent service accounts touching hosts or destinations outside baseline
// Builds a 30-day baseline of agent account activity, then surfaces deviations in the last 24h.
let AgentAccounts = dynamic(["svc-aiagent", "svc-agent", "svc-copilot", "svc-llm"]);
let Baseline =
    SecurityEvent
    | where TimeGenerated between (ago(30d) .. ago(1d))
    | where Account has_any (AgentAccounts)
    | where EventID == 4624
    | summarize BaselineHosts = make_set(Computer) by Account;
SecurityEvent
| where TimeGenerated > ago(24h)
| where Account has_any (AgentAccounts)
| where EventID == 4624
| summarize RecentHosts = make_set(Computer), LogonCount = count() by Account
| join kind=inner Baseline on Account
| extend NewHosts = set_difference(RecentHosts, BaselineHosts)
| where array_length(NewHosts) > 0
| project Account, NewHosts, LogonCount, RecentHosts
| extend Severity = iff(array_length(NewHosts) > 3, "High", "Medium");
// Companion hunt: agent runtimes making network connections to non-sanctioned destinations
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "node.exe")
| where RemoteUrl !has_any ("openai.com", "azure.com", "anthropic.com", "googleapis.com")
| where not(ipv4_is_private(RemoteIP))
| summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteIP), Destinations = make_set(RemoteUrl, 20)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where DistinctDestinations > 5
| order by DistinctDestinations desc;

-- Hunt for AI agent runtimes with unexpected child processes and network activity
-- Deploy across endpoints hosting agent workloads
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|curl|wget|certutil)'
  AND get(pid=Ppid).Name =~ '(?i)(python|node)'

-- Correlate: agent runtime processes holding active external connections
SELECT Pid, Name, CommandLine,
       netstat(Pid=Pid).RemoteAddr AS RemoteAddr,
       netstat(Pid=Pid).RemotePort AS RemotePort,
       netstat(Pid=Pid).Status AS ConnStatus
FROM pslist()
WHERE Name =~ '(?i)(python|node)'
  AND ConnStatus = 'ESTABLISHED'
  AND RemoteAddr !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

# AI Agent Containment Verification & Hardening Script
# Run on hosts running agentic AI workloads. Verifies egress controls, service account
# restrictions, and audit posture. Requires elevated privileges.

$Report = @()

# 1. Verify agent service accounts are denied interactive logon
$AgentAccounts = Get-LocalUser | Where-Object { $_.Name -match 'svc-(aiagent|agent|copilot|llm)' }
foreach ($acct in $AgentAccounts) {
    $Report += [PSCustomObject]@{
        Check  = "Interactive logon review: $($acct.Name)"
        Status = "MANUAL - Confirm '$($acct.Name)' is in 'Deny log on locally' and 'Deny log on through network' via GPO/secpol"
    }
}

# 2. Audit outbound firewall rules for agent runtimes (should be deny-by-default + allowlist)
$EgressRules = Get-NetFirewallRule -Direction Outbound -Action Allow -Enabled True |
    Get-NetFirewallApplicationFilter | Where-Object { $_.Program -match '(python|node)' }
if (-not $EgressRules) {
    $Report += [PSCustomObject]@{ Check = 'Egress restriction for agent runtimes'; Status = 'PASS - No blanket outbound allow rules for python/node' }
} else {
    $Report += [PSCustomObject]@{ Check = 'Egress restriction for agent runtimes'; Status = 'REVIEW - Outbound allow rules exist for agent runtimes; validate destination scoping' }
}

# 3. Create explicit deny-by-default egress rule for agent runtimes (uncomment to enforce)
# New-NetFirewallRule -DisplayName "AI Agent Egress - Deny Default (Python)" `
#     -Direction Outbound -Action Block -Program "C:\AgentRuntime\python.exe" -Enabled True
# Then add scoped ALLOW rules above it for sanctioned API endpoints only.

# 4. Verify process creation auditing with command line capture (Event 4688)
$CmdLineAudit = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
$Report += [PSCustomObject]@{
    Check  = '4688 command-line auditing'
    Status = if ($CmdLineAudit -eq 1) { 'PASS' } else { 'FAIL - Enable: Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit -Name ProcessCreationIncludeCmdLine_Enabled -Value 1' }
}

# 5. Verify PowerShell Script Block Logging (captures agent-invoked PS child processes)
$SBL = (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -ErrorAction SilentlyContinue).EnableScriptBlockLogging
$Report += [PSCustomObject]@{
    Check  = 'PowerShell Script Block Logging'
    Status = if ($SBL -eq 1) { 'PASS' } else { 'FAIL - Enable via GPO: Computer Config > Admin Templates > PowerShell > Turn on Script Block Logging' }
}

$Report | Format-Table -AutoSize