What are the signs that an AI coding agent is executing host-side commands outside the model tool log?

Look for child processes that sit under the agent process but never appear as approved model actions. Useful signals include unexpected git, shell, or helper process ancestry, filesystem changes during plain repository inspection, and commands launched while no tool call was granted. In this pattern, endpoint telemetry matters more than the transcript because the execution path is outside model visibility.

Why host-side command execution can hide from the agent transcript

The key issue is separation between model-visible actions and process-visible execution. An ai coding agent can appear to be “only thinking” or “only inspecting” in the transcript while a child process, shell, or helper binary is actually running on the host. That means the reliable evidence is often the process tree, not the agent’s own action log.

What makes this failure mode easy to miss is that normal developer workflows already spawn many transient helpers. A legitimate edit might launch git, a formatter, a language server, or a test runner. The signal is not “any child process at all”, but host-side execution that is not explainable by an approved tool call, especially when it occurs during read-only browsing or repository inspection.

Two observations matter most. First, the process ancestry should line up with a documented model action. Second, the side effects should match the stated intent. If the agent claims it is inspecting a file but the endpoint shows a shell spawning commands, network access, or filesystem writes, then the execution path has moved outside the model tool log and the transcript is no longer the source of truth.

What telemetry patterns usually give this away

Unexpected process ancestry is the strongest clue. Look for child processes under the agent binary that are not part of an approved tool invocation, especially shells, git, package managers, interpreters, or repo helpers that appear without a corresponding tool record. On their own, these processes are not proof of compromise, but they become highly suspicious when the model log shows no command authorization.

Filesystem drift is another practical indicator. If files change while the agent is supposedly only reading, or if temporary artifacts, lockfiles, and generated outputs appear during a passive step, that suggests the agent or a helper launched host-side work. In mature telemetry, that mismatch between stated action and observed side effect is often more useful than any single process name.

Timing also matters. Commands launched between tool calls, or during a pause where no tool was granted, are a strong sign that execution escaped the intended mediation layer. For investigations, pair process creation times with tool-call timestamps and compare them against the model transcript to find gaps, overlaps, and unlogged action bursts.

How practitioners should interpret the signal in practice

Host-side command execution should be treated as a visibility and control problem first, and a malware problem second. The immediate question is whether the agent runtime is correctly mediating execution through the tool interface, because once commands can run outside that path, policy enforcement, auditability, and rollback all weaken.

That is why endpoint telemetry is so important here. The transcript can show intent, but the endpoint shows effect. If you only monitor model messages, you can miss a process that edits code, invokes git, or reaches out to local tooling while leaving the approved tool log looking clean. The practitioner task is to verify whether every meaningful side effect has a corresponding, attributable model action.

Gemini CLI Breach, Silent Code Execution is a good example of why silent execution paths deserve separate scrutiny from the agent transcript. For broader context on hostile agent behavior and tool abuse, see Amazon Q AI Coding Agent Compromised and Replit AI Tool Database Deletion.

Risk and Threat Considerations

When host-side commands can run outside the model tool log, the main risk is loss of mediation. That creates a blind spot for auditing, policy enforcement, and incident reconstruction, and it also gives an attacker or misconfigured agent a path to do real work without an approved action trail.

Failure mechanism: A local helper, shell, or spawned process executes with the agent’s ambient privileges while the model transcript remains incomplete or misleading, so the control plane and the execution plane diverge.

Impact: Teams can miss code changes, destructive commands, secret access, or data exfiltration, and they may incorrectly trust a clean-looking tool log even after the host has already done the damage.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Agentic AI Top 10	ASI02 — Tool Misuse	Host-side commands outside the tool log are a tool-boundary failure.
	ASI03 — Identity & Privilege Abuse	Unlogged execution can use the agent's effective privilege without approval.
Recommendation — Constrain tool invocation paths and block unmediated command execution. Bind agent actions to least privilege and approved authorization states.
MITRE ATT&CK	T1059 — Command and Scripting Interpreter	Unexpected shell or script children are the core signal being hunted.
Recommendation — Hunt for unapproved interpreter activity in process telemetry.
NIST SP 800-53 Rev 5	AU-6 — Audit Review, Analysis, and Reporting	Detecting hidden execution depends on correlating logs and endpoint events.
	SI-4 — System Monitoring	Endpoint monitoring is required when transcript visibility is incomplete.
Recommendation — Correlate audit records with endpoint telemetry to expose unlogged actions. Monitor process ancestry and file changes for out-of-band execution.
OWASP ASVS	V16 — Security Logging and Error Handling	The question centers on whether logs reflect actual execution behavior.
Recommendation — Validate that security logs capture the actions that affect system state.

Practitioner Guidance

What to verify: Correlate process creation, parent-child ancestry, and filesystem events with the exact tool-call timeline. If a process changed state and has no matching approved action, treat that as a control gap rather than a logging anomaly.

Decision rule: If the agent can launch shell or helper commands without a corresponding mediated tool event, prioritize containment of the runtime and review of execution policy before you investigate whether the command was “expected”.

Practitioner takeaway: For this failure mode, the transcript is only advisory. Trust the endpoint when it disagrees with the agent log, because unlogged execution means your real control boundary has already been crossed.