Docs / Security / Covert coordination

covert_coordination

Agents coordinating through a shared external channel none of their operators is watching: a common paste site, a rendezvous API, a repository, a queue. Demonstrated publicly twice in a fortnight in September 2026 before Mesedi carried a counter for it. This detector is that counter, and it is honestly labeled as one.

What it does

When one of this run’s egress destinations was contacted by an unusual number of DISTINCT recent executions in the same project (default: 3 within 24 hours), the run clusters under covert_coordination:<destination> at Warning severity. It is nearly a copy of the provider_incident tenant counter by design, with distinct runs in place of distinct tenants and an egress destination in place of a provider error.

What it does not do

It counts convergence; it does not read intent. Three runs sharing a destination is a rendezvous OR a shared dependency the window has not aged out, which is why this class defaults to Warning rather than Critical: it warrants a look, not a page.

And it sees only egress the host application or sandbox REPORTED via egress events. A connection nobody reports is invisible, exactly as the sandbox_escape coverage boundary describes.

What to do as an operator

• Look at the destination first. A shared internal service or a common SaaS endpoint is a benign explanation and worth an allowlist note in your runbook. A destination none of your tooling should know about is not.
• Check which executions converged. The failure group lists them. Ask whether they share a tenant, a key, or a prompt source; convergence across UNRELATED tenants is the strongest version of this signal.
• Read what they wrote. If the destination is writable by the agents (a paste site, a repo, a bucket), the content is the answer.

Instrumentation it needs

Egress events from whatever opens the connections, via emit_egress (Python) or emitEgress (TypeScript). The SDK normalizes each destination to host or host:port before anything leaves your process, so paths, query strings, and any credentials embedded in a URL are never transmitted.