Cron Jobs
0
Governance
Security & policy
3 teams with AI activity this period. 4 security events (Machine Destruction ×1, Force Push ×1, Production Access ×1).
Week of 2026-08-24
Security events this period
4 total · click a category to filter the incident list
Machine Destruction
1
Filtered
Force Push
1
View incidents →
Sandbox Bypass
0
Production Access
1
View incidents →
Data Destruction
0
API key to model
1
View incidents →
SPI to model
0
What do these categories mean?
- Machine Destruction
- Destructive filesystem or disk commands — for example rm -rf on system paths, mkfs, writing to /dev with dd, or a fork bomb.
- Force Push
- git push with --force, -f, or --force-with-lease — can rewrite shared history on a remote.
- Cron Jobs
- crontab edits — persistent scheduled jobs that can outlive the agent session.
- Sandbox Bypass
- SSH to localhost / 127.0.0.1 — a common way to escape a tool sandbox into a fuller shell.
- Production Access
- High-impact production changes — kubectl delete or DROP TABLE against live systems.
- Data Destruction
- Bulk data wipe patterns — TRUNCATE TABLE or nuke-all-data style commands.
- API key to model
- API keys or access tokens detected in content headed to the model (OpenAI, Anthropic, AWS, GitHub, generic key assigns). Bodies are not stored.
- SPI to model
- Sensitive personal or infrastructural secrets in model-bound content — private keys, AWS secret keys, DB connection passwords, or SSN-like patterns. Bodies are not stored.
Showing type Machine Destruction · Clear type
Recent incidents
Latest matches — open a row for who, what, and team.
-
Machine Destruction · Pam Ellis · legacy · claude_code 2026-08-24 blocked Details
- Who
- Pam Ellis
- Team
- legacy
- What
- Machine Destruction — blocked by the local collector hook
- Client / repo
- Logistics Core github.com/northwind/logistics-core
- When · tool
- 2026-08-24 · claude_code rule rm_rf_root
Follow up with the person and their team lead — the tool call was stopped on-device.
No command body or prompt text is stored for this event.
All incidents
1 row for the current filters
| When | Type | Who | Team | Repo | Tool |
|---|---|---|---|---|---|
| 2026-08-24 |
Machine Destruction blocked DetailsMachine Destruction — blocked by the local collector hook Follow up with the person and their team lead — the tool call was stopped on-device. rule rm_rf_root No command body or prompt text is stored. |
Pam Ellis | legacy | github.com/northwind/logistics-core | claude_code |