GPT-6 Cyber: OpenAI's New Security Model — SOC Detection, Egress Control, and LLM Governance Guide

---
title: LLM Agent Framework Spawning Shell or Scripting Process
id: 3f8c2a91-7b4e-4d1a-9e6f-2c5a8d0b1e34
status: experimental
description: Detects Python or Node.js processes associated with LLM agent frameworks spawning shells or scripting engines. A common post-prompt-injection and sandbox-escape behavior where the agent runtime is induced to execute system commands.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://cyberscoop.com/openai-gpt-6-cyber-security-model/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_parent_cmd:
    ParentCommandLine|contains:
      - 'langchain'
      - 'autogen'
      - 'openai'
      - 'crewai'
      - 'mcp'
      - 'agent'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_parent_cmd and selection_child
falsepositives:
  - Legitimate agentic AI tooling that shells out for system info or file operations
  - Approved AI-assisted SOAR integrations
level: high
---
title: Outbound Connection to LLM API Endpoint From Non-Browser Process
id: 8b1e4d72-3a6c-4f29-b8d5-9e1c7a2f6034
status: experimental
description: Detects non-browser, non-approved processes establishing connections to major LLM provider API endpoints. Identifies shadow AI usage, data staging to external models, or injected agents beaconing to attacker-controlled API accounts.
references:
  - https://attack.mitre.org/techniques/T1041/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.cohere.ai'
      - 'api.mistral.ai'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection_dest and not filter_browsers
falsepositives:
  - Approved AI copilots, IDE assistants (Copilot, Cursor), and sanctioned agent tooling
  - SOC automation platforms with LLM enrichment enabled
level: medium
---
title: Linux Agent Runtime Executing Shell Commands
id: 5d2a9f18-6c3b-4e7a-a1d4-8f0c3b9e2156
status: experimental
description: Detects Python or Node processes running agentic AI workloads on Linux spawning interactive shells or download utilities, consistent with sandbox escape or prompt-injection-driven command execution.
references:
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/node'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Data science and MLOps pipelines that invoke shell utilities
  - Legitimate AI agent tool-use in approved sandboxed environments
level: medium

// Hunt 1: LLM agent runtimes spawning shells, scripting engines, or LOLBins
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "node.exe", "python", "node")
| where InitiatingProcessCommandLine has_any ("langchain", "autogen", "openai", "crewai", "mcp", "agent")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "bash", "sh", "wget", "curl", "nc", "socat")
| project TimeGenerated, DeviceName, AccountName,
          AgentCmd = InitiatingProcessCommandLine,
          ChildProcess = FileName, ChildCmd = ProcessCommandLine,
          SHA256, ReportId
| order by TimeGenerated desc

// Hunt 2: Non-browser processes egressing to LLM API endpoints (shadow AI / exfil)
let LlmEndpoints = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com", "api.cohere.ai", "api.mistral.ai"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (LlmEndpoints)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by Connections desc

// Hunt 3 (Linux via Syslog ingestion): agent runtimes executing shells or network tools
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("python", "node")
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "curl ", "wget ", "nc ", "socat")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for LLM agent processes and their network connections
SELECT Pid,
       Ppid,
       Name,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(langchain|autogen|openai|anthropic|crewai|mcp|llm|agent)'
   OR Exe =~ '(?i)(python|node)'

-- Correlate with live outbound connections to LLM provider infrastructure
SELECT Pid,
       Name,
       Status,
       LocalAddr,
       LocalPort,
       RemoteAddr,
       RemotePort
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RemoteAddr !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

# Audit-LLMEgress.ps1 — Shadow AI and LLM egress inventory (read-only)
# Run elevated on endpoints or export DNS/firewall logs to a central collector

$LlmDomains = @('api.openai.com','api.anthropic.com','generativelanguage.googleapis.com','api.cohere.ai','api.mistral.ai','chat.openai.com')

Write-Host '[*] Checking DNS client cache for LLM endpoint resolutions...' -ForegroundColor Cyan
Get-DnsClientCache | Where-Object {
    $entry = $_; $LlmDomains | Where-Object { $entry.Entry -like "*$_*" }
} | Select-Object Entry, Data, TimeToLive | Format-Table -AutoSize

Write-Host '[*] Checking active TCP connections to LLM endpoints...' -ForegroundColor Cyan
foreach ($domain in $LlmDomains) {
    try {
        $ips = (Resolve-DnsName -Name $domain -Type A -ErrorAction Stop).IPAddress
        foreach ($ip in $ips) {
            $conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
                     Where-Object { $_.RemoteAddress -eq $ip }
            foreach ($c in $conns) {
                $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
                [PSCustomObject]@{
                    Endpoint  = $domain
                    RemoteIP  = $ip
                    Process   = $proc.ProcessName
                    PID       = $c.OwningProcess
                    Path      = $proc.Path
                }
            }
        }
    } catch { }
}

Write-Host '[*] Auditing environment for exposed LLM API keys...' -ForegroundColor Cyan
foreach ($var in 'OPENAI_API_KEY','ANTHROPIC_API_KEY','AZURE_OPENAI_KEY') {
    $val = [Environment]::GetEnvironmentVariable($var, 'Machine')
    if ($val) { Write-Host "[!] $var is set at MACHINE scope — review necessity and rotation" -ForegroundColor Yellow }
}

Write-Host '[*] Done. Build your sanctioned-AI allowlist from these results before enforcing egress blocks.' -ForegroundColor Green

#!/bin/bash
# audit-llm-egress.sh — Linux egress audit for LLM endpoints (read-only)
DOMAINS="api.openai.com api.anthropic.com generativelanguage.googleapis.com api.cohere.ai api.mistral.ai"

echo "[*] Established connections to LLM provider IP ranges:"
for d in $DOMAINS; do
  for ip in $(getent ahosts "$d" 2>/dev/null | awk '{print $1}' | sort -u); do
    ss -tnp state established 2>/dev/null | grep "$ip" && echo "  ^^ matches $d"
  done
done

echo "[*] Processes referencing LLM frameworks in cmdline:"
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  cmd=$(tr '\0' ' ' < /proc/$pid/cmdline 2>/dev/null)
  case "$cmd" in
    *langchain*|*autogen*|*openai*|*anthropic*|*crewai*|*mcp*)
      echo "  PID $pid: $cmd" ;;
  esac
done

echo "[*] API keys present in environment of running processes (names only):"
grep -l -E 'OPENAI_API_KEY|ANTHROPIC_API_KEY' /proc/*/environ 2>/dev/null | while read -r f; do
  pid=$(echo "$f" | cut -d/ -f3)
  echo "  PID $pid ($(cat /proc/$pid/comm 2>/dev/null)) holds an LLM API key"
done

echo "[*] Audit complete. Block via egress firewall only after allowlisting sanctioned tooling."