(safedep.io) Behavioral Analysis of AI Coding Agents: Detecting Compromised Sessions Using Jev and Gryph In brief - This article describes a prototype system designed to detect compromised AI coding agents by monitoring their actions and flagging suspicious behavior based on developer profiles and organizational policies. Technically - This article details an observability pipeline using Gryph to hook into AI agents (e.g., Claude Code, Cursor) and record actions as JSON events. These events, along with a 50-line plain-text developer profile and a set of organizational policies, are passed to the Jev model from TypeSafe AI. Jev evaluates each event by answering a series of atomic yes-or-no (noul) questions—such as checking for data exfiltration, persistence, or secret access—returning probabilities for each. The system uses a sliding window of the previous 15 events for context and triggers alerts when risk probabilities exceed a threshold of 0.8. Source: https://safedep.io/ai-agent-security-jev-gryph #Cybersecurity