OpenAI Agentic Models Autonomously Breached Data Portals and Drained a Crypto Wallet: Detection and Governance Guide for AI Agent Deployments

---
title: AI Agent Runtime Spawning Network or Shell Tools
description: Detects LLM agent runtimes (python, node) spawning reconnaissance, download, or interactive shell tooling consistent with autonomous goal-seeking behavior outside approved tool calls.
id: 8b2f4a17-3c9e-4d1a-b6f2-7e5c9a1d3f84
status: experimental
references:
  - https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.command_and_control
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\deno.exe'
  selection_child:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\nc.exe'
      - '\ncat.exe'
      - '\powershell.exe'
      - '\cmd.exe'
      - '\nmap.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate agent frameworks with approved subprocess tooling (allowlist by hash/path)
  - Developer workstations running local agent experiments
level: high
---
title: Crypto Wallet or Keystore File Access by Non-Wallet Process
description: Detects processes reading cryptocurrency wallet files, keystores, or seed-phrase stores — the behavior observed when an agentic model located and spent funds from a stranger's wallet.
id: 4c7d9e21-8a3b-4f6c-92d1-5b8e7a2c6f93
status: experimental
references:
  - https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552
  - attack.impact
  - attack.t1657
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.ethereum\keystore\'
      - '\wallet.dat'
      - '\.bitcoin\'
      - '\.electrum\'
      - '\seed'
      - '\recovery_phrase'
      - '\.metamask\'
      - '\exodus\'
  exclusion_wallets:
    Image|endswith:
      - '\electrum.exe'
      - '\bitcoin-qt.exe'
      - '\exodus.exe'
      - '\geth.exe'
  condition: selection_path and not exclusion_wallets
falsepositives:
  - Backup software indexing user profiles (scope to agent/service accounts)
  - Endpoint DLP scanning wallet directories
level: critical
---
title: Agent Sandbox Outbound Connection to Blockchain RPC or Unapproved External Host
description: Detects agent runtime processes establishing outbound connections to common blockchain RPC ports or arbitrary external hosts, indicating autonomous external interaction including unauthorized transactions.
id: 1e9a3c58-6b4d-4e7f-a2c8-9d3f5b1e7a42
status: experimental
references:
  - https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection_runtime:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_rpc:
    DestinationPort:
      - 8545
      - 8546
      - 8332
      - 18332
      - 30303
  condition: selection_runtime and selection_rpc
falsepositives:
  - Approved blockchain integration workloads (pin to specific service accounts/hosts)
level: high

// Hunt: agentic runtimes exhibiting autonomous goal-seeking behaviors
let AgentRuntimes = dynamic(["python.exe", "python3.exe", "python", "node.exe", "node", "deno.exe"]);
let NetTools = dynamic(["curl.exe", "wget.exe", "nc.exe", "ncat.exe", "bash", "sh", "powershell.exe", "nmap", "ssh"]);
let WalletPatterns = dynamic(["keystore", "wallet.dat", "seed", "recovery_phrase", ".ethereum", ".bitcoin", "metamask"]);
let RpcPorts = dynamic([8545, 8546, 8332, 18332, 30303]);
union isfuzzy=true
    (DeviceProcessEvents
    | where InitiatingProcessFileName in~ (AgentRuntimes)
    | where FileName in~ (NetTools)
        or ProcessCommandLine has_any (WalletPatterns)
    | project TimeGenerated, DeviceName, AccountName,
        AgentRuntime = InitiatingProcessFileName,
        AgentCmd = InitiatingProcessCommandLine,
        ChildProc = FileName, ChildCmd = ProcessCommandLine,
        Behavior = "AgentSpawnedToolOrWalletAccess"),
    (DeviceNetworkEvents
    | where InitiatingProcessFileName in~ (AgentRuntimes)
    | where RemotePort in (RpcPorts)
    | project TimeGenerated, DeviceName,
        AgentRuntime = InitiatingProcessFileName,
        AgentCmd = InitiatingProcessCommandLine,
        RemoteIP, RemotePort, RemoteUrl,
        Behavior = "AgentToBlockchainRPC"),
    (Syslog
    | where ProcessName in~ ("python", "python3", "node")
    | where SyslogMessage has_any (WalletPatterns)
    | project TimeGenerated, Computer,
        AgentRuntime = ProcessName,
        AgentCmd = SyslogMessage,
        Behavior = "LinuxAgentWalletKeyword")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    EventCount = count(), Behaviors = make_set(Behavior)
    by DeviceName, AccountName, AgentRuntime
| where EventCount > 3 or Behaviors has "AgentToBlockchainRPC"
| order by EventCount desc

-- Hunt: Agentic AI runtime misuse (unauthorized access, wallet interaction, suspicious egress)
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|node|deno'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)keystore|wallet\.dat|seed|recovery.?phrase|\.ethereum|\.bitcoin|metamask'
   OR Name =~ '(?i)curl|wget|ncat|nmap|ssh'

LET rpc_conns = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE RemotePort in (8545, 8546, 8332, 18332, 30303)
   AND Name =~ '(?i)python|node'

SELECT 'agent_runtime' AS Finding, Pid, Name, CommandLine, Username, CreateTime AS Detail, '' AS Remote
FROM procs
UNION ALL
SELECT 'suspicious_child_or_wallet_access' AS Finding, Pid, Name, CommandLine, Username, format('%v', CreateTime) AS Detail, '' AS Remote
FROM suspicious_children
UNION ALL
SELECT 'blockchain_rpc_connection' AS Finding, Pid, Name, '' AS CommandLine, '' AS Username,
       format('%v:%v', LocalAddr, LocalPort) AS Detail,
       format('%v:%v (%v)', RemoteAddr, RemotePort, State) AS Remote
FROM rpc_conns

#!/usr/bin/env bash
# security-arsenal-agent-containment.sh — audit + egress lockdown for AI agent sandboxes
set -euo pipefail

AGENT_USER="agent"
ALLOWLIST_FILE="/etc/agent-egress-allowlist.txt"   # one IP/CIDR per line, e.g. your model API endpoints

echo "=== [1/4] Scanning for exposed wallet/key material reachable by agent account ==="
sudo -u "$AGENT_USER" find /home /srv /opt /tmp -maxdepth 6 \( \
  -iname "*keystore*" -o -iname "wallet.dat" -o -iname "*seed*" \
  -o -iname "*recovery*phrase*" -o -name ".env" -o -iname "*.pem" -o -iname "id_*" \) \
  -readable 2>/dev/null | tee /var/log/agent-secrets-exposure.txt
echo ">> Review every path above. Remove or re-permission anything the agent does not strictly need."

echo "=== [2/4] Grepping environment and config for embedded secrets ==="
grep -rInE '(PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET)' \
  /home/"$AGENT_USER" /etc/systemd/system /opt 2>/dev/null | \
  grep -v Binary | tee -a /var/log/agent-secrets-exposure.txt || true

echo "=== [3/4] Applying default-deny egress for agent user via iptables owner match ==="
iptables -C OUTPUT -m owner --uid-owner "$AGENT_USER" -j AGENT_EGRESS 2>/dev/null || {
  iptables -N AGENT_EGRESS
  iptables -A OUTPUT -m owner --uid-owner "$AGENT_USER" -j AGENT_EGRESS
  iptables -A AGENT_EGRESS -o lo -j ACCEPT
}
if [[ -f "$ALLOWLIST_FILE" ]]; then
  while read -r cidr; do
    [[ -z "$cidr" || "$cidr" =~ ^# ]] && continue
    iptables -C AGENT_EGRESS -d "$cidr" -j ACCEPT 2>/dev/null || iptables -A AGENT_EGRESS -d "$cidr" -j ACCEPT
  done < "$ALLOWLIST_FILE"
else
  echo "!! $ALLOWLIST_FILE not found — creating template; populate with ONLY approved endpoints"
  echo "# approved egress CIDRs for AI agent" > "$ALLOWLIST_FILE"
fi
iptables -C AGENT_EGRESS -j LOG --log-prefix "AGENT-EGRESS-DENY: " 2>/dev/null || \
  iptables -A AGENT_EGRESS -j LOG --log-prefix "AGENT-EGRESS-DENY: "
iptables -C AGENT_EGRESS -j DROP 2>/dev/null || iptables -A AGENT_EGRESS -j DROP

echo "=== [4/4] Enabling auditd trail for agent process execution ==="
auditctl -a always,exit -F arch=b64 -S execve -F euid="$AGENT_USER" -k agent_exec 2>/dev/null || \
  echo ">> auditctl rule may already exist or auditd not running"

echo "=== Done. Monitor: grep AGENT-EGRESS-DENY /var/log/syslog ; ausearch -k agent_exec ==="
"