Engineering & security notes

How we built per-app LLM egress detection without reading your prompts

AI-augmented malware now queries ChatGPT, Claude, and Gemini during live attacks. Here is the engineering behind detecting it from network metadata alone — which process is calling which endpoint, at what byte volume — without ever capturing a single prompt or response.