CommunityJev Guides & Articles
Detecting compromised coding agents with Jev
Kunal Singh records coding-agent actions with Gryph and asks Jev yes-or-no questions against a short profile of how that developer usually works.
- Format
- Article
- Published by
- Community
- Author
- Kunal Singh
- Last verified
- Sep 2026
Highlights
- 25 September 2026. Gryph records each action. Jev answers narrow yes-or-no questions against a developer profile and org policy.
- The check flagged all 14 synthetic attacks he wrote. On real work it let 5,225 of 5,398 events pass.
- The run cost $0.81. His Claude Code sessions produced 6,426 events in 10 days.
- Gryph hooks Claude Code, Codex, Cursor, Gemini CLI, and Windsurf, and stores events locally.
Watch out
The attacks were written by the author. The real traffic is two developers, a coworker and himself. He asks in the post whether the results are good enough.
Questions about this entry
Short answers drawn from the linked project or page.
His own. He wrote the 14 synthetic attacks, so flagging all of them shows the pipeline can catch the patterns he had in mind, not that it generalises. The real traffic behind it is two developers, himself and a co-worker, which is a very small base.
About 173 real actions flagged out of 5,398, roughly 3%. His own sessions produced 6,426 events in 10 days, so you are looking at a stream nobody reads by hand and a false-positive rate you would still have to tune per developer.
$0.81 for the entire run. Gryph records each action to a local database, exportable to OpenSearch, and Jev answers a short list of narrow yes-or-no questions per action against a developer profile and org policy. Detection depends on that profile matching the developer rather than on command signatures.
Nothing documented here. Because the judgment leans on how that person normally works plus org rules, an attacker who mimics the baseline is the obvious gap, and the post does not measure evasion of the profile. He also asks in the text whether the results are good enough.
Gryph uses agent hooks to catch each action and stores one JSON object per action in a local database on the developer's own laptop, exportable to OpenSearch. It hooks Claude Code, Codex, Cursor, Gemini CLI, Windsurf, and other agents, and each event records the session, working directory, action type, tool name, result status, and payload.
Two things beyond the event itself: the developer profile of how this person normally works, and the organization's policies that apply to everyone. Jev answers a short list of narrow yes-or-no questions over those, and a few lines of code turn the answers into a verdict, so detection leans on the baseline matching the developer.
The action_type field decides which payload fields are present. The sample covered command_exec, file_read, file_write, tool_use, session_start, session_end, notification, and two subagent events, with a trimmed example showing a Bash command_exec that curls a local dev server and records exit code 0.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsYouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.
sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker NewsX: Secret detection with Jev, tested
More Jev resources like this
Hacker News link to SafeDep's write-up on Gryph telemetry plus narrow Jev yes/no checks against developer policy.
Jev Guides & ArticlesPost#community#security#agents
Community
A black-box pass over ten public datasets with jev-1.13.0: injection detection, reranking, intent, tool routing, and three tasks the author says do not work.
Jev Guides & ArticlesArticle#community#article#evaluation
Community
Archestra labels 100 production Claude Code tool calls and compares Jev with a constant benign baseline, Sonnet 5, Laya, and several open decoders.
Jev Guides & ArticlesArticle#community#article#evaluation
Community
2.6kGitHub stars
Cisco's security scanner for agent skills added a System One analyzer: it sends the full skill text to POST /v1/systemone as one advisory Noul question and records the probability, while being deliberately unable to emit a finding or change a severity.
Jev Tools & CLIs#community#security#agent-skills
Community
cisco-ai-defense/skill-scannerPython
cisco-ai-defense/skill-scannerPython2.3kGitHub stars
A curated community list of public projects and practices built on Jev, grouped by direct Jev application domain with explicit inclusion rules and a category for practice signals like threads and interviews.
Jev Guides & Articles#community#awesome-list#documentation
Community
yibie/awesome-jevPython
yibie/awesome-jevPythonSuperagent's security triage model: a continual fine-tune of AutoJev-27B that returns calibrated probabilities for prompt-injection and content checks, with a release policy at 0.70 unsafe.
Jev Models & Reimplementations#community#open-models#local
Community
From the Jev guides
Original write-ups on what this entry is for.
The typed-answer shape removes a category of data risk, not all of it. Zero data retention per surface, the legal set to read, and the controls that remain yours to run.
Jev Guides & Articles#privacy#compliance#legal
Read article
TypeSafe serves Jev from one API. A second tier of independent sites wraps it with their own keys, credits, and playgrounds. How to read the disclaimers before you paste a key.
Jev Guides & Articles#ecosystem#trust#hosting
Read article
The first ten days produced three receptions that rarely meet: a Product Hunt launch, a 620-point Hacker News thread, and a r/LocalLLaMA that doubted the framing. Reading them together.
Jev Guides & Articles#launch#community#reception
Read article
From the Jev community
Posts from builders shipping with Jev right now.