Limits
Bypasses — a compromised agent that knows EgressEye is present
| Bypass | Why it works |
|---|---|
| Edit the harness hook configuration | Hooks live in files the agent can write |
| Spawn processes that skip the harness | Collection happens at the tool-call layer only |
| Use tools/SDKs that make direct connections | No tool call, no observation |
| Non-HTTP protocols (raw sockets, DNS tunneling) | v1 extracts URLs only |
| Obfuscate beyond defanging | Heuristics catch common forms, not all forms |
| Hide secrets in "benign" encodings | Secret patterns are textual |
| Split exfiltration across hosts | Aggregation is per-host; cross-host patterns are future work |
False positives to expect
- Shortened domains and shared hosts near the edit-distance threshold
- Legitimately new domains — a startup's week-old docs site
- Non-standard ports on internal services
- Multi-purpose constants that look like tokens (the entropy gate reduces this)
- Several all-caps constants in one command reading as a pasted
.env
The default feed is a rolling window
The OpenPhish community feed holds only ~300 recent entries — coverage for a given host decays within days, and a URL that was flagged yesterday can legitimately be unknown today. For real protection, add a keyed source (EGRESS_EYE_URLHAUS_AUTH_KEY, EGRESS_EYE_GSB_KEY).
Operational limits
unknownis the default verdict on purpose: "no evidence either way" — not "safe", not "dangerous". Blocking mode only ever fires on feed-confirmed hits.- RDAP lookups are budgeted (3 fresh lookups per hook run) and cached 30 days; unsupported TLDs report "unknown age".
- Measured per-call hook latency: ~86 ms median at a 50k-row mirror, Node-boot floor (~45–55 ms) at the default feed size.
- Two concurrent sessions share the pointer file only when the harness provides no session id.
- Windows is the primary development target; the core has no OS-specific parts.
Blocking, when you ask for it
Set EGRESS_EYE_BLOCK=1 and feed-confirmed malicious tool calls are denied (exit 2, or a JSON deny decision where the harness mangles exit codes — that's the Codex adapter's default). It is still not a hard security boundary: treat EgressEye as the audit layer on top of a sandbox with default-deny egress, not instead of one.