The CISO worklist — what each agent did that needs a human, by severity and control.

Framework:

Findings

7 of 7 · behavioral (capability · credential · data · consumption)

SeverityFindingWhoFramework

highApprovals & sandbox bypassed (--yolo)marketing-gpt runs with approvals and sandbox disabled — it can take any action without a human gate.▸ remediation: Require an approval policy; disable --yolo; run sandboxed.marketing-gptpid:4410:marketing-gptOWASP LLM06 Excessive Agency · OWASP Agentic · Insecure tool usehighAgent running as rootmarketing-gpt and support-copilot execute as root — a compromised prompt inherits full host privilege.▸ remediation: Drop privileges; run under a dedicated low-privilege service account.marketing-gptpid:4410:marketing-gptMITRE ATLAS · Privilege Escalation · OWASP LLM06mediumStatic API key on consumer-aliased identityCodex CLI authenticates with a long-lived API key bound to a duck.com alias, not an org-backed identity.▸ remediation: Move to org-backed OAuth; rotate the static key; join the alias to your IdP.Codex CLIpid:2210:codexMITRE ATLAS · Credential Access · OWASP LLM (Non-Human Identity)mediumSensitive files read into agent contextClaude Code read ./.env and ~/.aws/credentials into its working context.▸ remediation: Scope retrieval; add a deny rule for credential paths; enable content inspection.Claude Codepid:865:claude-codeOWASP LLM02 Sensitive Information Disclosure · NIST AI RMF · MEASUREmediumUnbounded token consumption — no spend ceilingdata-pipeline-agent consumed 9.2M tokens with no per-agent ceiling configured.▸ remediation: Set a per-agent spend ceiling and alert; review batch sizing.data-pipeline-agentpid:5520:data-pipelineOWASP LLM10 Unbounded Consumption · NIST AI RMF · MANAGElowShadow agent installed but unmonitoredZed Agent is installed and active on jane-mbp but reports no telemetry — we are blind to its behavior.▸ remediation: Instrument it through qcontrol, or remove it.Zed Agentpid:7740:zedNIST AI RMF · MAP · Agent inventory completeness

infoSuspected classifier false positives (3)3 non-instrumented processes were flagged by substring exe match — almost certainly classifier over-matching, not real agent risk.▸ remediation: Tracked as a qcontrol data-quality issue, not suppressed here.—fleet-wideData Quality · qcontrol classifier

Fields: findings.severity · title · detail · remediation · framework · agent · entity_id — from app/data/c16-fleet.ts (qcontrol /api/security shape).