{ "apps": [ { "app_id": "autogen", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Always set max_consecutive_auto_reply limits. Use Docker execution for code generation. Implement conversation length caps. Never deploy with internet-accessible code execution.", "name": "AutoGen", "permission_scope": [ "network_access", "files_read", "files_write", "shell_execute" ], "pip_packages": [ "autogen", "pyautogen", "autogen-agentchat" ], "risk_profile": "critical", "risk_reason": "Multi-agent system with code execution and autonomous loops. Agents can write and execute Python code, run indefinitely, and spawn sub-conversations without human oversight" }, { "app_id": "autogpt", "category": "agent_framework", "cli_commands": [ "autogpt" ], "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mitigation": "Run only inside a container or VM. Never give it your real shell or unlimited API keys. Cap iterations explicitly.", "name": "AutoGPT", "permission_scope": [ "network_access", "files_read", "files_write", "shell_execute" ], "pip_packages": [ "autogpt", "agpt" ], "risk_profile": "critical", "risk_reason": "Autonomous agent that can write and execute code, read and write files, browse the web, and call APIs without per-step confirmation" }, { "app_id": "babyagi", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mitigation": "Always set iteration limits. Run in isolated environment. Monitor task generation for scope creep.", "name": "BabyAGI", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "babyagi" ], "risk_profile": "critical", "risk_reason": "Autonomous task-creation agent \u2014 generates and executes its own task list indefinitely, creating new sub-tasks without human approval" }, { "app_id": "composio", "category": "agent_framework", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Audit connected integrations. Use least-privilege OAuth scopes. Monitor tool invocations.", "name": "Composio", "permission_scope": [ "network_access", "files_read", "git_access" ], "pip_packages": [ "composio-core", "composio" ], "risk_profile": "high", "risk_reason": "Tool integration platform for AI agents \u2014 provides 150+ tool integrations (GitHub, Slack, databases) that agents can call autonomously" }, { "app_id": "crewai", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Define strict role boundaries per agent. Limit tool access per crew member. Log all inter-agent delegations. Test with adversarial scenarios before deployment.", "name": "CrewAI", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "crewai" ], "risk_profile": "high", "risk_reason": "Multi-agent orchestration with autonomous task delegation. Agents delegate sub-tasks to each other, amplifying the blast radius of any single compromised agent" }, { "app_id": "dify", "category": "agent_framework", "cli_commands": [ "dify" ], "cost_tier": "freemium", "data_egress": "mixed", "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "api.dify.ai" ], "llm_provider": "multiple", "mitigation": "Use local model providers for sensitive workflows. Restrict tool access per workflow. Enable Dify's audit log. Keep the self-hosted instance behind a VPN.", "name": "Dify", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "dify-client" ], "process_names": [ "dify", "dify-api", "dify-worker" ], "risk_profile": "high", "risk_reason": "Self-hosted LLM app builder \u2014 can run multi-step workflows, call external APIs, execute code, and ingest data sources. Cloud APIs receive workflow inputs which may include sensitive enterprise data." }, { "app_id": "flowise", "category": "agent_framework", "cli_commands": [ "flowise" ], "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Add authentication (FLOWISE_USERNAME/PASSWORD env vars). Restrict to localhost. Audit each flow for tool scope. Don't expose publicly without an API key.", "name": "Flowise", "npm_packages": [ "flowise" ], "permission_scope": [ "network_access", "files_read", "shell_execute" ], "process_names": [ "flowise" ], "risk_profile": "high", "risk_reason": "Visual drag-and-drop agent builder \u2014 chains LLMs, tools, and vector stores. Flows often run autonomously and can call external APIs, execute code, and read files." }, { "app_id": "haystack", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Validate pipeline inputs. Sanitize documents for injection. Monitor pipeline execution.", "name": "Haystack", "permission_scope": [ "network_access", "files_read" ], "pip_packages": [ "haystack-ai", "farm-haystack" ], "risk_profile": "medium", "risk_reason": "NLP/RAG pipeline framework \u2014 builds pipelines that process and query documents with LLMs" }, { "app_id": "langchain", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Use LangChain's tool permission system. Avoid shell/file tools in production agents. Implement human-in-the-loop for high-risk actions. Monitor agent traces via LangSmith.", "name": "LangChain", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "langchain", "langchain-core" ], "risk_profile": "high", "risk_reason": "Agent framework with tool execution and chain-of-action patterns. Agents can autonomously decide which tools to call, including shell, file, and web tools" }, { "app_id": "langflow", "category": "agent_framework", "cli_commands": [ "langflow" ], "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Add authentication in Langflow settings. Run behind a firewall. Review each flow's tool access. Use local LLMs for sensitive pipelines.", "name": "Langflow", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "langflow" ], "process_names": [ "langflow" ], "risk_profile": "high", "risk_reason": "Visual LangChain builder \u2014 composes LLM chains, agents, and tools via a web UI. Flows can execute shell commands, query databases, and call external APIs autonomously." }, { "app_id": "langgraph", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Set max iteration limits. Implement checkpoints and human-in-the-loop breakpoints. Monitor state transitions.", "name": "LangGraph", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "langgraph" ], "risk_profile": "high", "risk_reason": "Stateful agent orchestration with cyclical workflows \u2014 agents can loop, branch, and make autonomous decisions with persistent memory" }, { "app_id": "llamaindex", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Sanitize ingested documents for injection patterns. Use metadata filtering to isolate data sources. Validate query results before acting on them.", "name": "LlamaIndex", "permission_scope": [ "network_access", "files_read" ], "pip_packages": [ "llama-index", "llama_index" ], "risk_profile": "medium", "risk_reason": "RAG framework with data ingestion and query pipelines. Ingests documents that may contain prompt injection payloads embedded in data sources" }, { "app_id": "metagpt", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mitigation": "Keep the workspace dir isolated. Review generated code before running the test/deploy steps.", "name": "MetaGPT", "permission_scope": [ "network_access", "files_read", "files_write", "shell_execute" ], "pip_packages": [ "metagpt" ], "risk_profile": "critical", "risk_reason": "Multi-agent framework that simulates a software team \u2014 agents can write and execute code and modify files across a project" }, { "app_id": "n8n", "category": "agent_framework", "cli_commands": [ "n8n" ], "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Enable n8n authentication. Restrict credentials to least-privilege. Review AI Agent nodes for unbounded tool access. Don't expose on 0.0.0.0 without auth.", "name": "n8n (AI Workflow Automation)", "npm_packages": [ "n8n" ], "permission_scope": [ "network_access", "files_read", "shell_execute" ], "process_names": [ "n8n" ], "risk_profile": "high", "risk_reason": "Workflow automation with AI nodes \u2014 can call LLMs, access files, query databases, send emails, post to Slack, and interact with any HTTP API, all unattended." }, { "app_id": "opendevin", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.anthropic.com", "api.openai.com" ], "llm_provider": "multiple", "mitigation": "Uses Docker sandboxing by default \u2014 keep that on. Don't mount your real home directory.", "name": "OpenDevin / OpenHands", "permission_scope": [ "network_access", "files_read", "files_write", "shell_execute" ], "pip_packages": [ "opendevin", "openhands" ], "process_names": [ "opendevin", "openhands" ], "risk_profile": "critical", "risk_reason": "Open-source autonomous coding agent \u2014 full shell access, file write, and network access inside its sandbox" }, { "app_id": "phidata", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Restrict tool access. Monitor database queries. Validate web search results.", "name": "Phidata", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "phidata" ], "risk_profile": "high", "risk_reason": "AI agent framework with built-in tools for web search, database queries, and file operations" }, { "app_id": "pydantic-ai", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com" ], "llm_provider": "multiple", "mitigation": "Define strict tool allowlists. Validate tool outputs before acting on them. Monitor model usage costs.", "name": "Pydantic AI", "permission_scope": [ "network_access" ], "pip_packages": [ "pydantic-ai", "pydantic_ai" ], "risk_profile": "medium", "risk_reason": "Type-safe agent framework from the Pydantic team \u2014 structured tool use and dependency injection for LLM agents. Agents can call arbitrary tools with validated inputs." }, { "app_id": "semantic-kernel", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "multiple", "mitigation": "Restrict plugin permissions. Validate planner outputs. Use function-level access controls.", "name": "Semantic Kernel (Microsoft)", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "semantic-kernel" ], "risk_profile": "high", "risk_reason": "Microsoft's AI orchestration SDK \u2014 integrates LLMs with native functions, plugins, and planners that can execute code autonomously" }, { "app_id": "smolagents", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Restrict available tools. Use sandboxed execution. Monitor agent actions.", "name": "smolagents (Hugging Face)", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "smolagents" ], "risk_profile": "high", "risk_reason": "Hugging Face agent framework \u2014 lightweight but allows code execution and tool use with minimal guardrails" }, { "app_id": "superagi", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "multiple", "mitigation": "Set strict resource limits. Disable self-spawning in production. Monitor all tool invocations.", "name": "SuperAGI", "permission_scope": [ "network_access", "files_read", "shell_execute" ], "pip_packages": [ "superagi" ], "risk_profile": "critical", "risk_reason": "Autonomous agent platform with tool execution, resource management, and self-spawning capabilities \u2014 agents can create sub-agents" }, { "app_id": "swe-agent", "category": "agent_framework", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.anthropic.com", "api.openai.com" ], "llm_provider": "multiple", "mitigation": "Only run against test repos or fresh clones you're willing to lose. Uses Docker by default \u2014 keep it on.", "name": "SWE-agent", "permission_scope": [ "network_access", "files_read", "files_write", "shell_execute" ], "pip_packages": [ "sweagent", "swe-agent" ], "risk_profile": "critical", "risk_reason": "Agentic coding agent designed to reproduce and fix GitHub issues \u2014 full repo read/write + command execution" }, { "app_id": "litellm", "category": "ai_gateway", "cli_commands": [ "litellm" ], "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "localhost:4000" ], "llm_provider": "multiple", "mitigation": "Review logging config. Secure API key storage. Monitor request patterns for exfiltration.", "name": "LiteLLM Proxy", "permission_scope": [ "network_access" ], "pip_packages": [ "litellm" ], "risk_profile": "high", "risk_reason": "LLM API gateway \u2014 routes requests to 100+ LLM providers, manages API keys, can log all prompts/responses if configured" }, { "app_id": "openrouter", "category": "ai_gateway", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "openrouter.ai" ], "llm_provider": "multiple", "mitigation": "Monitor model selection. Review cost settings. Use spending limits.", "name": "OpenRouter SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "openrouter" ], "risk_profile": "medium", "risk_reason": "Multi-model API gateway \u2014 routes to OpenAI, Anthropic, Google, and others through a single API" }, { "app_id": "chatgpt-agent", "category": "autonomous-agent-framework", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "operator.chatgpt.com", "api.openai.com", "chatgpt.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/ChatGPT.app" ], "mitigation": "Enable AariaSec proxy to flag agent-mode sessions by endpoint. Limit agent's filesystem scope via OS sandboxing. Review the action log before approving each step.", "name": "ChatGPT Agent (Operator)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access" ], "process_names": [ "ChatGPT", "ChatGPT Helper", "ChatGPT Helper (Renderer)" ], "risk_profile": "high", "risk_reason": "OpenAI's computer-using agent. Runs inside the ChatGPT desktop app; takes browser, file, and shell actions on behalf of the user. Distinguished from plain ChatGPT by traffic to operator.chatgpt.com." }, { "app_id": "devin", "category": "autonomous-agent-framework", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "app.devin.ai", "api.cognition.ai" ], "llm_provider": "anthropic", "mac_paths": [ "/Applications/Devin.app" ], "mitigation": "Treat Devin sessions as a separate org-level identity. Apply egress allow-list to sensitive repos. Review every PR Devin authors with human sign-off \u2014 do not auto-merge.", "name": "Devin (Cognition AI)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Devin", "Devin.exe", "Devin Helper" ], "risk_profile": "critical", "risk_reason": "Autonomous software engineer \u2014 operates a full sandbox with shell, browser, and file access. Long-horizon agentic execution with minimal human approval. Primarily cloud-hosted; desktop wrapper if installed gives the same egress posture.", "win_paths": [ "{LOCALAPPDATA}/Programs/Devin/Devin.exe" ] }, { "app_id": "hermes-agent", "category": "autonomous-agent-framework", "cost_tier": "free", "data_egress": "cloud+local", "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "localhost:11434" ], "llm_provider": "multi", "mitigation": "Apply capability token enforcement (C82). Monitor for messaging-platform API egress (AWR-257). Behavioral fingerprint drift triggers relearning window \u2014 treat as new agent identity after skill acquisition events.", "name": "Hermes Agent (NousResearch)", "permission_scope": [ "network_access", "filesystem_read", "filesystem_write", "process_spawn", "persistent_memory" ], "pip_packages": [ "hermes-agent", "nousresearch-hermes" ], "risk_profile": "critical", "risk_reason": "Self-improving autonomous agent with cross-session skill creation, persistent memory, multi-platform C2 channels (Telegram/Discord/WhatsApp/Signal/email), concurrent subagent spawning. Behavioral fingerprint will drift across sessions due to learned skills." }, { "app_id": "arc-browser", "category": "browser", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Arc.app" ], "mitigation": "Disable Arc Max features you don't use. Opt out in Settings \u2192 Max.", "name": "Arc Browser (Max AI)", "permission_scope": [ "network_access", "browser" ], "process_names": [ "Arc" ], "risk_profile": "medium", "risk_reason": "Built-in AI summarisation and tab browsing \u2014 reads page content and sends it to third-party LLMs" }, { "app_id": "brave-leo", "category": "browser", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.anthropic.com", "ai-chat.bsg.brave.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Brave Browser.app" ], "mitigation": "Leo can be disabled per-site. Default to 'no assistant' mode on sensitive tabs.", "name": "Brave Browser (Leo AI)", "permission_scope": [ "network_access", "browser" ], "process_names": [ "Brave Browser", "brave", "brave.exe" ], "risk_profile": "medium", "risk_reason": "Leo AI assistant reads page content, answers questions, and can summarise \u2014 content leaves the browser", "win_paths": [ "{PROGRAMFILES}/BraveSoftware/Brave-Browser/Application/brave.exe" ] }, { "app_id": "chatgpt-atlas", "category": "browser", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "chatgpt.com", "api.openai.com", "operator.chatgpt.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/ChatGPT Atlas.app", "/Applications/Atlas.app" ], "mitigation": "Disable Agent Mode for sensitive SaaS apps. Enforce SSO/MFA on every site Atlas can reach. Audit Atlas's session log per user.", "name": "ChatGPT Atlas Browser", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "ChatGPT Atlas", "Atlas", "Atlas Helper", "Atlas Helper (Renderer)", "Atlas Helper (GPU)" ], "risk_profile": "high", "risk_reason": "OpenAI's browser, launched October 2025. Agent Mode performs multi-step autonomous browsing \u2014 fills forms, navigates SaaS apps, submits actions on the user's behalf. Treat as a delegated user identity, not just a browser.", "win_paths": [ "{LOCALAPPDATA}/Programs/ChatGPT Atlas/Atlas.exe" ] }, { "app_id": "chrome-gemini", "category": "browser", "cost_tier": "freemium", "data_egress": "cloud", "linux_paths": [ "/usr/bin/google-chrome", "/usr/bin/google-chrome-stable", "/usr/bin/chromium-browser", "/usr/bin/chromium", "/snap/bin/chromium" ], "llm_endpoints": [ "generativelanguage.googleapis.com", "gemini.google.com" ], "llm_provider": "google", "mac_paths": [ "/Applications/Google Chrome.app" ], "mitigation": "Disable 'Help me write' and tab summarisation in Chrome Settings \u2192 Gemini. Use managed browser policies (GenAiDefaultSettings) to disable fleet-wide.", "name": "Chrome (Gemini AI)", "permission_scope": [ "network_access", "browser" ], "process_names": [ "Google Chrome", "chrome", "chrome.exe", "chromium", "chromium-browser" ], "risk_profile": "medium", "risk_reason": "Chrome 121+ ships Gemini as a native browser assistant (Ask Gemini in address bar, tab summarisation, Help me write). Page content is sent to Google's Gemini API without explicit per-prompt consent.", "win_paths": [ "{PROGRAMFILES}/Google/Chrome/Application/chrome.exe", "{PROGRAMFILES(X86)}/Google/Chrome/Application/chrome.exe", "{LOCALAPPDATA}/Google/Chrome/Application/chrome.exe" ] }, { "app_id": "dia-browser", "category": "browser", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "diabrowser.com", "thebrowser.company", "api.anthropic.com" ], "llm_provider": "anthropic", "mac_paths": [ "/Applications/Dia.app" ], "mitigation": "Treat as both a browser AND an Atlassian access channel. Enforce SSO on Atlassian + content-scope policies on Dia's agent mode.", "name": "Dia Browser (Atlassian)", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Dia", "Dia.exe", "Dia Helper", "Dia Helper (Renderer)", "Dia Helper (GPU)" ], "risk_profile": "high", "risk_reason": "The Browser Company's Dia, acquired by Atlassian September 2025. Positioned as 'the browser for knowledge workers' \u2014 integrates with Jira/Confluence + has agentic browsing. Likely default install in Atlassian-shop orgs.", "win_paths": [ "{LOCALAPPDATA}/Programs/Dia/Dia.exe" ] }, { "app_id": "edge-copilot", "category": "browser", "cost_tier": "freemium", "data_egress": "cloud", "linux_paths": [ "/usr/bin/microsoft-edge", "/usr/bin/microsoft-edge-stable" ], "llm_endpoints": [ "www.bing.com", "copilot.microsoft.com", "sydney.bing.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Microsoft Edge.app" ], "mitigation": "Disable Copilot sidebar in Edge Settings \u2192 Sidebar \u2192 Copilot. Enterprise: use EdgeEnableCopilot group policy (set to Disabled). Restrict bing.com/copilot.microsoft.com at the proxy level.", "name": "Microsoft Edge (Copilot AI)", "permission_scope": [ "network_access", "browser" ], "process_names": [ "Microsoft Edge", "msedge", "msedge.exe" ], "risk_profile": "medium", "risk_reason": "Edge ships Copilot (formerly Bing AI) as a persistent sidebar panel. It can read the current page, summarise content, compose email, and answer questions \u2014 page text sent to Microsoft's Azure OpenAI endpoints.", "win_paths": [ "{PROGRAMFILES}/Microsoft/Edge/Application/msedge.exe", "{PROGRAMFILES(X86)}/Microsoft/Edge/Application/msedge.exe", "{LOCALAPPDATA}/Microsoft/Edge/Application/msedge.exe" ] }, { "app_id": "opera-aria", "category": "browser", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "composer.opera-api.com", "api.openai.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Opera.app" ], "mitigation": "Sign out of Aria on shared machines. Disable 'page-aware chat' per site.", "name": "Opera (Aria)", "permission_scope": [ "network_access", "browser" ], "process_names": [ "Opera" ], "risk_profile": "medium", "risk_reason": "Aria is always-on in the sidebar \u2014 can read the current page, generate text, and execute browser actions" }, { "app_id": "perplexity-comet", "category": "browser", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "www.perplexity.ai", "api.perplexity.ai" ], "llm_provider": "perplexity", "mac_paths": [ "/Applications/Comet.app" ], "mitigation": "Review Comet's default 'act on the page' permission. Disable agent mode on banking and mail sites.", "name": "Perplexity Comet Browser", "permission_scope": [ "network_access", "browser", "files_read" ], "process_names": [ "Comet" ], "risk_profile": "high", "risk_reason": "AI-native browser \u2014 can autonomously click, fill forms, and navigate pages on the user's behalf. Significant agent permission scope" }, { "app_id": "sigma-os", "category": "browser", "cost_tier": "free", "data_egress": "cloud", "linux_paths": [ "/usr/bin/sigmaos", "/opt/SigmaOS/sigmaos" ], "llm_endpoints": [ "sigmaos.com", "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/SigmaOS.app" ], "mitigation": "Block at MDM if not approved. Enforce egress allow-list on managed networks.", "name": "SigmaOS Browser", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "SigmaOS", "SigmaOS Helper", "SigmaOS Helper (Renderer)" ], "risk_profile": "medium", "risk_reason": "Free agentic browser across all major OSes. Low-friction install \u2014 typically arrives via personal adoption before IT notices. Lower install base than Atlas/Dia but growing.", "win_paths": [ "{LOCALAPPDATA}/Programs/SigmaOS/SigmaOS.exe" ] }, { "app_id": "aichat-cli", "brew_names": [ "aichat" ], "category": "cli", "cli_commands": [ "aichat" ], "cost_tier": "free", "data_egress": "mixed", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Avoid piping sensitive data. Review which provider is configured.", "name": "AIChat", "permission_scope": [ "network_access" ], "risk_profile": "low", "risk_reason": "Terminal chat client for multiple LLM providers \u2014 sends prompts to configured API" }, { "app_id": "aider", "category": "cli", "cli_commands": [ "aider" ], "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Use --no-auto-commits to require manual review. Run in a feature branch, never directly on main. Review diffs before accepting changes.", "name": "Aider", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "pip_packages": [ "aider-chat", "aider" ], "process_names": [ "aider" ], "risk_profile": "high", "risk_reason": "Autonomous code editing with git commit capability. Can modify files and commit directly to your repository without review gates" }, { "app_id": "avante-nvim", "category": "cli", "cost_tier": "free", "data_egress": "mixed", "linux_paths": [ "{HOME}/.config/nvim" ], "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com" ], "llm_provider": "multiple", "mac_paths": [ "/Users/aj/.config/nvim" ], "mitigation": "Audit the configured provider in the plugin's Lua config under ~/.config/nvim. Prefer a monitored endpoint for sensitive repos.", "name": "avante.nvim", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "nvim" ], "risk_profile": "medium", "risk_reason": "Cursor-style AI coding plugin for Neovim \u2014 sends buffer/code context to whichever OpenAI-compatible endpoint is configured, including self-hosted or third-party proxies" }, { "app_id": "claude-code", "category": "cli", "cli_commands": [ "claude" ], "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.anthropic.com" ], "llm_provider": "anthropic", "mitigation": "Use permission mode (--allowedTools) to restrict which tools Claude Code can use. Run in a sandboxed environment or container for untrusted repos. Review git diffs before allowing pushes. Set CLAUDE.md rules to constrain behavior per-project.", "name": "Claude Code", "npm_packages": [ "@anthropic-ai/claude-code" ], "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "claude" ], "risk_profile": "critical", "risk_reason": "Full shell access, file read/write, autonomous multi-step execution. Can run any command, install packages, modify system files, and push to git \u2014 all without mandatory human approval" }, { "app_id": "codecompanion-nvim", "category": "cli", "cost_tier": "free", "data_egress": "mixed", "linux_paths": [ "{HOME}/.config/nvim" ], "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com" ], "llm_provider": "multiple", "mac_paths": [ "/Users/aj/.config/nvim" ], "mitigation": "Audit the adapters table in the plugin's Lua config under ~/.config/nvim. Use local models (Ollama) for sensitive codebases.", "name": "codecompanion.nvim", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "nvim" ], "risk_profile": "medium", "risk_reason": "Chat/agentic coding plugin for Neovim with configurable OpenAI-compatible adapters \u2014 sends buffer context to whichever backend is configured" }, { "app_id": "github-copilot-cli", "category": "cli", "cli_commands": [ "github-copilot-cli", "ghcs", "ghce" ], "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "copilot-proxy.githubusercontent.com" ], "llm_provider": "openai", "mitigation": "Always review generated commands before executing. Avoid piping directly to shell.", "name": "GitHub Copilot CLI", "npm_packages": [ "@githubnext/github-copilot-cli" ], "permission_scope": [ "shell_execute", "network_access" ], "risk_profile": "medium", "risk_reason": "AI-powered CLI suggestions \u2014 translates natural language to shell commands, can suggest destructive commands" }, { "app_id": "llm-cli", "category": "cli", "cli_commands": [ "llm" ], "cost_tier": "free", "data_egress": "mixed", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Review installed plugins. Be cautious piping sensitive data.", "name": "LLM CLI (Simon Willison)", "permission_scope": [ "network_access", "shell_execute" ], "pip_packages": [ "llm" ], "risk_profile": "low", "risk_reason": "Command-line LLM client \u2014 sends prompts to configured provider. Supports plugins for tool use" }, { "app_id": "open-interpreter", "category": "cli", "cli_commands": [ "interpreter" ], "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Never run in production environments. Use --safe-mode. Run in a sandboxed VM/container. Review every code execution before approval.", "name": "Open Interpreter", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "browser", "system_settings" ], "pip_packages": [ "open-interpreter" ], "risk_profile": "critical", "risk_reason": "AI agent with FULL system access \u2014 can execute arbitrary code, install software, access files, browse web, and control your computer autonomously" }, { "app_id": "codex-cli", "category": "cli", "cli_commands": [ "codex" ], "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mitigation": "Use sandbox mode. Review all file changes before accepting. Set execution limits.", "name": "OpenAI Codex CLI", "npm_packages": [ "@openai/codex" ], "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "risk_profile": "critical", "risk_reason": "OpenAI's CLI agent \u2014 full shell access, autonomous code generation, file read/write, and multi-step execution" }, { "app_id": "shell-gpt", "category": "cli", "cli_commands": [ "sgpt" ], "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mitigation": "Avoid --execute mode for untrusted prompts. Review generated commands before running. Don't pipe sensitive data.", "name": "Shell-GPT", "permission_scope": [ "shell_execute", "network_access" ], "pip_packages": [ "shell-gpt" ], "risk_profile": "medium", "risk_reason": "AI shell assistant \u2014 can generate and execute shell commands based on natural language, with direct shell execution mode" }, { "app_id": "supermaven-cli", "category": "cli", "cli_commands": [ "supermaven" ], "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "supermaven.com" ], "llm_provider": "supermaven", "mitigation": "Use Supermaven Team for SOC2-compliant processing. Disable in sensitive repos.", "name": "Supermaven (CLI)", "permission_scope": [ "network_access", "files_read" ], "risk_profile": "medium", "risk_reason": "Fast autocomplete model \u2014 sends nearby file context to Supermaven's servers" }, { "app_id": "warp-terminal", "brew_names": [ "warp" ], "category": "cli", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.warp.dev" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Warp.app" ], "mitigation": "Review AI-suggested commands before executing. Be cautious with sensitive environment variables visible in terminal.", "name": "Warp Terminal", "permission_scope": [ "shell_execute", "network_access", "clipboard" ], "process_names": [ "Warp", "warp" ], "risk_profile": "medium", "risk_reason": "Terminal with AI command suggestions \u2014 sends command context to Warp cloud for AI-powered completions and explanations" }, { "app_id": "comfyui", "category": "creative_tool", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:8188" ], "llm_provider": "local", "mitigation": "Audit installed custom nodes. Keep bound to localhost. Don't install untrusted nodes.", "name": "ComfyUI", "permission_scope": [ "network_access", "files_read", "files_write" ], "pip_packages": [ "comfyui" ], "risk_profile": "medium", "risk_reason": "Node-based image generation \u2014 custom nodes can execute arbitrary code" }, { "app_id": "fooocus", "category": "creative_tool", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:7865" ], "llm_provider": "local", "mitigation": "Keep bound to localhost.", "name": "Fooocus", "permission_scope": [ "network_access", "files_read", "files_write" ], "pip_packages": [ "fooocus" ], "risk_profile": "low", "risk_reason": "Simplified local image generation \u2014 minimal extension system, lower risk" }, { "app_id": "invokeai", "category": "creative_tool", "cli_commands": [ "invokeai" ], "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:9090" ], "llm_provider": "local", "mitigation": "Keep bound to localhost.", "name": "InvokeAI", "permission_scope": [ "network_access", "files_read", "files_write" ], "pip_packages": [ "invokeai" ], "risk_profile": "low", "risk_reason": "Local image generation with structured workflow \u2014 limited extension capabilities" }, { "app_id": "stable-diffusion-webui", "category": "creative_tool", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:7860" ], "llm_provider": "local", "mitigation": "Audit installed extensions. Keep bound to localhost. Don't install untrusted extensions.", "name": "Stable Diffusion WebUI", "permission_scope": [ "network_access", "files_read", "files_write" ], "pip_packages": [ "gradio" ], "process_names": [ "webui.sh" ], "risk_profile": "medium", "risk_reason": "Local image generation with web UI \u2014 extensions can add arbitrary functionality including internet access" }, { "app_id": "chatgpt-desktop", "category": "desktop_app", "cost_tier": "freemium", "data_egress": "cloud", "linux_paths": [], "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/ChatGPT.app", "/Applications/ChatGPT Atlas.app" ], "mitigation": "Disable unused plugins. Review plugin permissions before enabling. Avoid pasting sensitive data into conversations with plugins active.", "name": "ChatGPT Desktop", "permission_scope": [ "network_access", "browser" ], "process_names": [ "ChatGPT", "ChatGPT.exe" ], "risk_profile": "medium", "risk_reason": "Plugin/action system can access external services, send data to third-party APIs, and execute multi-step workflows", "win_paths": [ "{LOCALAPPDATA}/Programs/ChatGPT/ChatGPT.exe" ] }, { "app_id": "claude-desktop", "category": "desktop_app", "cost_tier": "paid", "data_egress": "cloud", "linux_paths": [ "/opt/Claude/claude", "{HOME}/.local/share/Claude/claude" ], "llm_endpoints": [ "api.anthropic.com" ], "llm_provider": "anthropic", "mac_paths": [ "/Applications/Claude.app" ], "mitigation": "Audit installed MCP servers regularly. Remove unused servers. Use allowlists for permitted tool actions. Monitor with AariaSec proxy.", "name": "Claude Desktop", "permission_scope": [ "network_access", "files_read", "files_write", "browser" ], "process_names": [ "Claude", "Claude.exe" ], "risk_profile": "medium", "risk_reason": "MCP tool use can execute arbitrary actions \u2014 file I/O, web requests, and shell commands via installed MCP servers", "win_paths": [ "{LOCALAPPDATA}/Programs/Claude/Claude.exe" ] }, { "app_id": "bundle-codex", "category": "desktop_app", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "chatgpt.com", "api.openai.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Codex.app" ], "mitigation": "Review execution prompts carefully. Keep AariaSec monitoring enabled. Use scoped workspaces and approval checks for sensitive repos.", "name": "Codex", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Codex", "Codex Helper", "Codex Helper (Renderer)", "Codex Helper (GPU)", "Codex Helper (Plugin)" ], "risk_profile": "critical", "risk_reason": "Desktop coding agent with file read/write, shell execution, multi-step autonomous behavior, and broad codebase access" }, { "app_id": "goose", "brew_names": [ "goose" ], "category": "desktop_app", "cli_commands": [ "goose" ], "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Goose.app" ], "mitigation": "Review installed MCP extensions. Restrict shell access in Goose settings. Monitor tool invocations. Run in sandboxed environment for untrusted tasks.", "name": "Goose (Block)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Goose", "goosed", "Goose Helper", "Goose Helper (Renderer)", "Goose Helper (GPU)" ], "risk_profile": "critical", "risk_reason": "Autonomous AI agent by Block \u2014 full shell access, file read/write, MCP tool use, and multi-step autonomous execution without mandatory human approval" }, { "app_id": "perplexity-desktop", "category": "desktop_app", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "www.perplexity.ai", "api.perplexity.ai" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Perplexity.app" ], "mitigation": "Avoid pasting sensitive data. Review search context before sharing conversations.", "name": "Perplexity", "permission_scope": [ "network_access", "browser" ], "process_names": [ "Perplexity", "Perplexity.exe" ], "risk_profile": "low", "risk_reason": "Search-augmented LLM \u2014 primarily read-only web queries, limited local file access", "uses_system_pac": true, "win_paths": [ "{LOCALAPPDATA}/Programs/Perplexity/Perplexity.exe" ] }, { "app_id": "pieces-desktop", "category": "desktop_app", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Pieces for Developers.app", "/Applications/Pieces.app" ], "mitigation": "Review which snippets are synced. Disable cloud features for sensitive code. Use local-only mode if available.", "name": "Pieces for Developers", "permission_scope": [ "network_access", "files_read" ], "process_names": [ "Pieces", "Pieces for Developers", "pieces_os" ], "risk_profile": "medium", "risk_reason": "Code snippet manager with AI features \u2014 indexes local code snippets and sends to cloud LLM for enrichment" }, { "app_id": "raycast-ai", "category": "desktop_app", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Raycast.app" ], "mitigation": "Audit installed Raycast extensions. Disable AI features for sensitive workflows. Review clipboard access.", "name": "Raycast (AI Features)", "permission_scope": [ "network_access", "files_read", "clipboard", "system_settings" ], "process_names": [ "Raycast" ], "risk_profile": "medium", "risk_reason": "Launcher with AI extensions \u2014 can access clipboard, files, and system commands via AI-powered workflows" }, { "app_id": "spark-mail-ai", "category": "desktop_app", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Spark.app", "/Applications/Spark \u2013 Email App.app" ], "mitigation": "Disable AI features for sensitive email threads. Review AI-generated responses before sending.", "name": "Spark Mail (AI)", "permission_scope": [ "network_access" ], "process_names": [ "Spark" ], "risk_profile": "medium", "risk_reason": "Email client with AI compose/summarize \u2014 sends email content to cloud LLM for processing" }, { "app_id": "amazon-q", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "codewhisperer.us-east-1.amazonaws.com" ], "llm_provider": "multiple", "mitigation": "Review IAM permissions. Disable for non-AWS projects. Review suggested code before accepting.", "name": "Amazon Q Developer", "permission_scope": [ "files_read", "network_access" ], "risk_profile": "medium", "risk_reason": "AWS AI coding assistant \u2014 sends code context to AWS for suggestions, can generate code and interact with AWS services", "vscode_extensions": [ "amazonwebservices.amazon-q-vscode" ] }, { "app_id": "antigravity", "category": "ide", "cost_tier": "enterprise", "data_egress": "enterprise_cloud", "llm_endpoints": [ "generativelanguage.googleapis.com", "cloudcode-pa.googleapis.com" ], "llm_provider": "google", "mac_paths": [ "/Applications/Antigravity.app" ], "mitigation": "Review which workspaces are open. Audit installed extensions. Be cautious with proprietary code \u2014 context is sent to Google Cloud for AI features.", "name": "Antigravity (Google)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Antigravity", "Antigravity Helper", "Antigravity Helper (Renderer)", "Antigravity Helper (Plugin)", "Antigravity Helper (GPU)" ], "risk_profile": "high", "risk_reason": "Google AI IDE with full codebase access, autonomous code generation, terminal execution, and built-in Gemini integration. Sends code context to Google Cloud servers", "uses_system_pac": true }, { "app_id": "augment-code", "category": "ide", "cost_tier": "paid", "data_egress": "cloud", "linux_paths": [ "/usr/bin/augment", "/opt/Augment/augment" ], "llm_endpoints": [ "augmentcode.com", "api.augmentcode.com", "api.anthropic.com" ], "llm_provider": "anthropic", "mac_paths": [ "/Applications/Augment.app" ], "mitigation": "Use workspace allow-list. Review which repos are indexed. Enable SAML SSO + audit log integration on the enterprise plan.", "name": "Augment Code", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Augment", "Augment.exe", "Augment Helper" ], "risk_profile": "high", "risk_reason": "Enterprise coding agent specifically built for large monorepos. Ingests entire repo for context \u2014 high-volume code egress posture.", "vscode_extensions": [ "augment.vscode-augment" ], "win_paths": [ "{LOCALAPPDATA}/Programs/Augment/Augment.exe" ] }, { "app_id": "blackbox-ai", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.blackbox.ai", "www.blackbox.ai" ], "llm_provider": "blackbox", "mitigation": "Review Blackbox's privacy policy. Disable for repos with proprietary code. Consider switching to a provider with clearer data-use terms.", "name": "Blackbox AI (VS Code)", "permission_scope": [ "network_access", "files_read" ], "risk_profile": "medium", "risk_reason": "Inline code completion and search \u2014 sends code context to Blackbox AI's cloud. Data retention and training policies are less transparent than major providers.", "vscode_extensions": [ "blackboxapp.blackbox" ] }, { "app_id": "cline", "category": "ide", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.anthropic.com", "api.openai.com" ], "llm_provider": "multiple", "mitigation": "Enable approval mode for file changes. Review terminal commands before execution. Set spending limits on API usage.", "name": "Cline (Claude Dev)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "browser", "git_access" ], "risk_profile": "high", "risk_reason": "Autonomous AI coding agent in VS Code \u2014 can create/edit/delete files, run terminal commands, and browse the web without per-action approval", "vscode_extensions": [ "saoudrizwan.claude-dev" ] }, { "app_id": "codeium", "category": "ide", "cli_commands": [ "codeium" ], "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "server.codeium.com" ], "llm_provider": "codeium", "mitigation": "Codeium offers a self-hosted Enterprise plan. For individuals, disable in regulated repos via .codeiumignore.", "name": "Codeium", "permission_scope": [ "network_access", "files_read" ], "pip_packages": [ "codeium" ], "risk_profile": "medium", "risk_reason": "Inline code completion and chat \u2014 sends file context to Codeium's servers" }, { "app_id": "continue-jetbrains", "category": "ide", "cost_tier": "free", "data_egress": "mixed", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Audit which model provider is configured in the plugin's config.json. Use local models (Ollama) for sensitive codebases.", "name": "Continue for JetBrains", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "idea", "pycharm", "goland", "webstorm", "rider" ], "risk_profile": "medium", "risk_reason": "Continue's JetBrains plugin mirrors the VS Code extension's configurable-backend design \u2014 sends code context to whichever LLM provider is configured in its config.json, including self-hosted models" }, { "app_id": "continue-dev", "category": "ide", "cost_tier": "free", "data_egress": "mixed", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Audit which model provider is configured. Use local models (Ollama) for sensitive codebases. Review context window to ensure secrets aren't included.", "name": "Continue.dev", "permission_scope": [ "files_read", "network_access", "git_access" ], "risk_profile": "medium", "risk_reason": "Code assistant with configurable model backends \u2014 sends code context to whichever LLM provider is configured, including self-hosted models", "vscode_extensions": [ "continue.continue" ] }, { "app_id": "cursor-ide", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "linux_paths": [ "/usr/bin/cursor", "/opt/Cursor/cursor", "{HOME}/.local/bin/cursor" ], "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Cursor.app" ], "mitigation": "Use workspace-scoped permissions. Review AI-generated diffs before accepting. Avoid opening repos with secrets in environment files. Enable Cursor's confirmation prompts for terminal commands.", "name": "Cursor IDE", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Cursor", "Cursor.exe" ], "risk_profile": "high", "risk_reason": "Full codebase access + autonomous code generation + terminal execution. Can read/write any file in your project and run shell commands", "uses_system_pac": true, "win_paths": [ "{LOCALAPPDATA}/Programs/Cursor/Cursor.exe" ] }, { "app_id": "vscode-copilot", "category": "ide", "cost_tier": "paid", "data_egress": "cloud", "linux_paths": [ "/usr/bin/code", "/usr/share/code/code", "/snap/bin/code" ], "llm_endpoints": [ "api.openai.com", "copilot-proxy.githubusercontent.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Visual Studio Code.app" ], "mitigation": "Use .copilotignore to exclude sensitive files. Disable Copilot for repos with proprietary code. Review Copilot Chat suggestions before executing terminal commands.", "name": "GitHub Copilot (VS Code)", "permission_scope": [ "files_read", "network_access", "shell_execute", "git_access" ], "process_names": [ "Code", "Code.exe", "code", "Code Helper", "Code Helper (Renderer)", "Code Helper (GPU)", "Code Helper (Plugin)" ], "risk_profile": "medium", "risk_reason": "Sends code context to cloud for suggestions. Copilot Chat can run terminal commands. Full repository context sent to GitHub servers", "uses_system_pac": true, "vscode_extensions": [ "github.copilot", "github.copilot-chat" ], "win_paths": [ "{LOCALAPPDATA}/Programs/Microsoft VS Code/Code.exe", "{PROGRAMFILES}/Microsoft VS Code/Code.exe" ] }, { "app_id": "jetbrains-ai", "category": "ide", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.jetbrains.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/IntelliJ IDEA.app", "/Applications/PyCharm.app", "/Applications/PyCharm Professional.app", "/Applications/GoLand.app", "/Applications/WebStorm.app", "/Applications/Rider.app", "/Applications/RustRover.app" ], "mitigation": "Enable AI Assistant per-project. Junie (agent mode) should only be used on codebases you're willing to diff carefully.", "name": "JetBrains AI Assistant", "permission_scope": [ "network_access", "files_read", "files_write" ], "process_names": [ "idea", "pycharm", "goland", "webstorm", "rider" ], "risk_profile": "medium", "risk_reason": "AI Assistant reads your codebase for context, generates code, and (with Junie) can autonomously edit multiple files" }, { "app_id": "kiro", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "linux_paths": [ "/usr/bin/kiro", "/opt/Kiro/kiro", "{HOME}/.local/bin/kiro" ], "llm_endpoints": [ "api.anthropic.com", "bedrock-runtime.us-east-1.amazonaws.com", "bedrock-runtime.us-west-2.amazonaws.com" ], "llm_provider": "anthropic", "mac_paths": [ "/Applications/Kiro.app" ], "mitigation": "Use workspace-scoped permissions. Review AI-generated diffs before accepting. Avoid opening repos with credentials in environment files. Enable Kiro's per-action approval for terminal commands.", "name": "Kiro (Amazon)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Kiro", "Kiro.exe", "Kiro Helper", "Kiro Helper (Renderer)", "Kiro Helper (GPU)", "Kiro Helper (Plugin)", "kiro" ], "risk_profile": "high", "risk_reason": "Amazon's AI-native IDE \u2014 autonomous spec-driven coding with file read/write, shell execution, and multi-step agentic loops. Routes to Anthropic Claude via Bedrock or direct.", "win_paths": [ "{LOCALAPPDATA}/Programs/Kiro/Kiro.exe" ] }, { "app_id": "pearai", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/PearAI.app" ], "mitigation": "Review AI actions before accepting. Use workspace-scoped settings.", "name": "PearAI", "permission_scope": [ "files_read", "files_write", "network_access", "git_access" ], "process_names": [ "PearAI" ], "risk_profile": "medium", "risk_reason": "AI-native IDE with autonomous coding capabilities \u2014 sends codebase context to cloud LLM", "uses_system_pac": true }, { "app_id": "pieces-vscode", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "multiple", "mitigation": "Review which snippets are saved. Disable cloud sync for sensitive code.", "name": "Pieces for VS Code", "permission_scope": [ "files_read", "network_access" ], "risk_profile": "medium", "risk_reason": "Code snippet copilot \u2014 indexes and sends code context to cloud for AI-powered enrichment", "vscode_extensions": [ "meshintelligenttechnologiesinc.pieces-vscode" ] }, { "app_id": "proxyai-jetbrains", "category": "ide", "cost_tier": "freemium", "data_egress": "mixed", "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com" ], "llm_provider": "multiple", "mitigation": "Audit the custom base URL under the plugin's provider settings. Prefer a monitored/first-party endpoint. Review context scope before enabling on sensitive repos.", "name": "ProxyAI (CodeGPT) for JetBrains", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "idea", "pycharm", "goland", "webstorm", "rider" ], "risk_profile": "medium", "risk_reason": "ProxyAI (formerly CodeGPT) runs inside JetBrains IDEs and lets the user point at a custom/self-hosted model base URL \u2014 code context is sent to whichever provider is configured, including third-party proxies outside JetBrains' own AI Assistant" }, { "app_id": "roo-code", "category": "ide", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.anthropic.com", "api.openai.com" ], "llm_provider": "multiple", "mitigation": "Enable approval mode. Review all file changes before accepting. Monitor terminal command execution.", "name": "Roo Code", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "risk_profile": "high", "risk_reason": "Autonomous AI coding agent (Cline fork) \u2014 full file system and terminal access with multi-step execution", "vscode_extensions": [ "rooveterinaryinc.roo-cline" ] }, { "app_id": "cody", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "sourcegraph.com" ], "llm_provider": "multiple", "mitigation": "Use Sourcegraph's self-hosted option for proprietary code. Configure repo-level access controls. Exclude sensitive repos from indexing via .cody/ignore.", "name": "Sourcegraph Cody", "permission_scope": [ "files_read", "network_access", "git_access" ], "risk_profile": "medium", "risk_reason": "Full codebase indexing with cloud processing \u2014 your entire repository is indexed and searchable on Sourcegraph servers", "vscode_extensions": [ "sourcegraph.cody-ai" ] }, { "app_id": "supermaven", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.supermaven.com" ], "llm_provider": "multiple", "mitigation": "Review which files are included in context. Disable for sensitive repositories.", "name": "Supermaven", "permission_scope": [ "files_read", "network_access" ], "risk_profile": "medium", "risk_reason": "AI code completion with large context window \u2014 sends extensive code context to cloud for suggestions", "vscode_extensions": [ "supermaven-inc.supermaven" ] }, { "app_id": "tabnine", "category": "ide", "cost_tier": "freemium", "data_egress": "mixed", "llm_endpoints": [ "api.tabnine.com" ], "llm_provider": "multiple", "mitigation": "Use Tabnine's local model for sensitive code. Configure code privacy settings. Review completions before accepting.", "name": "Tabnine", "permission_scope": [ "files_read", "network_access" ], "risk_profile": "medium", "risk_reason": "AI code completion \u2014 sends code context to Tabnine cloud or local model for suggestions", "vscode_extensions": [ "tabnine.tabnine-vscode" ] }, { "app_id": "trae-ide", "category": "ide", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Trae.app" ], "mitigation": "Review data privacy policy. Consider data jurisdiction implications. Avoid use on proprietary codebases.", "name": "Trae (ByteDance)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Trae", "Trae.exe" ], "risk_profile": "high", "risk_reason": "ByteDance AI IDE \u2014 data jurisdiction concerns, full codebase access, autonomous code generation with file system writes", "uses_system_pac": true }, { "app_id": "void-editor", "category": "ide", "cost_tier": "free", "data_egress": "mixed", "linux_paths": [ "/usr/bin/void", "{HOME}/.local/bin/void" ], "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Void.app" ], "mitigation": "Use local models where possible. Review AI-generated code before accepting.", "name": "Void Editor", "permission_scope": [ "files_read", "files_write", "network_access", "git_access" ], "process_names": [ "Void", "void" ], "risk_profile": "medium", "risk_reason": "Open-source AI code editor \u2014 sends code context to configured model provider" }, { "app_id": "windsurf-ide", "category": "ide", "cost_tier": "freemium", "data_egress": "cloud", "linux_paths": [ "/usr/bin/windsurf", "{HOME}/.local/bin/windsurf" ], "llm_endpoints": [ "api.codeium.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Windsurf.app" ], "mitigation": "Use project-scoped workspaces. Review Cascade agent actions in the activity log. Keep version control active so changes can be reverted.", "name": "Windsurf (Codeium)", "permission_scope": [ "files_read", "files_write", "shell_execute", "network_access", "git_access" ], "process_names": [ "Windsurf", "Windsurf.exe" ], "risk_profile": "high", "risk_reason": "Autonomous coding agent with file system access \u2014 can create, modify, and delete files across your project without per-action approval", "uses_system_pac": true, "win_paths": [ "{LOCALAPPDATA}/Programs/Windsurf/Windsurf.exe" ] }, { "app_id": "zed-editor", "brew_names": [ "zed" ], "category": "ide", "cost_tier": "free", "data_egress": "mixed", "linux_paths": [ "/usr/bin/zed", "{HOME}/.local/bin/zed" ], "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Zed.app" ], "mitigation": "Configure which LLM provider to use. Review AI suggestions before accepting. Use local models for sensitive code.", "name": "Zed Editor", "permission_scope": [ "files_read", "network_access", "git_access" ], "process_names": [ "Zed", "zed" ], "risk_profile": "medium", "risk_reason": "AI-powered code editor with inline assistant \u2014 sends code context to configured LLM provider" }, { "app_id": "anythingllm", "category": "local_llm", "cost_tier": "free", "data_egress": "mixed", "linux_paths": [ "/opt/AnythingLLM/anythingllm", "/usr/bin/anythingllm" ], "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "localhost:11434" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/AnythingLLM.app", "/Applications/AnythingLLM Desktop.app" ], "mitigation": "Use Ollama (local) as the LLM provider for sensitive documents. Audit which LLM backend is configured in Settings. Don't ingest classified files when a cloud provider is active.", "name": "AnythingLLM", "permission_scope": [ "network_access", "files_read" ], "process_names": [ "AnythingLLM", "AnythingLLM Desktop", "AnythingLLM.exe" ], "risk_profile": "medium", "risk_reason": "Local RAG application that ingests documents (PDFs, Word files, code) and sends them to whichever LLM provider is configured \u2014 cloud providers receive full document content.", "win_paths": [ "{LOCALAPPDATA}/Programs/AnythingLLM/AnythingLLM.exe", "{LOCALAPPDATA}/AnythingLLM Desktop/AnythingLLM Desktop.exe" ] }, { "app_id": "gpt4all", "category": "local_llm", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:4891" ], "llm_provider": "local", "mac_paths": [ "/Applications/GPT4All.app" ], "mitigation": "Keep local API server bound to localhost if enabled.", "name": "GPT4All", "permission_scope": [ "network_access" ], "pip_packages": [ "gpt4all" ], "process_names": [ "GPT4All", "gpt4all" ], "risk_profile": "low", "risk_reason": "Local LLM runner \u2014 runs models entirely on your machine, no cloud connection" }, { "app_id": "jan-ai", "category": "local_llm", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:1337" ], "llm_provider": "local", "mac_paths": [ "/Applications/Jan.app" ], "mitigation": "Disable remote model access for air-gapped use. Keep API server on localhost.", "name": "Jan", "permission_scope": [ "network_access" ], "process_names": [ "Jan", "jan" ], "risk_profile": "low", "risk_reason": "Open-source local AI assistant \u2014 runs models locally with optional remote API access", "win_paths": [ "{LOCALAPPDATA}/Programs/Jan/Jan.exe" ] }, { "app_id": "koboldcpp", "category": "local_llm", "cli_commands": [ "koboldcpp" ], "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:5001" ], "llm_provider": "local", "mitigation": "Keep bound to localhost. Don't expose publicly.", "name": "KoboldCpp", "permission_scope": [ "network_access" ], "process_names": [ "koboldcpp" ], "risk_profile": "low", "risk_reason": "Local LLM inference via llama.cpp \u2014 web UI + API server" }, { "app_id": "lm-studio", "category": "local_llm", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:1234" ], "llm_provider": "local", "mac_paths": [ "/Applications/LM Studio.app" ], "mitigation": "Keep server bound to localhost. Don't expose on 0.0.0.0 without authentication.", "name": "LM Studio", "permission_scope": [ "network_access" ], "process_names": [ "LM Studio", "lm-studio", "LM Studio.exe" ], "risk_profile": "low", "risk_reason": "Local LLM inference with OpenAI-compatible API \u2014 no data egress by default", "win_paths": [ "{LOCALAPPDATA}/Programs/LM Studio/LM Studio.exe", "{LOCALAPPDATA}/LM-Studio/LM Studio.exe" ] }, { "app_id": "localai", "category": "local_llm", "cli_commands": [ "local-ai" ], "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:8080" ], "llm_provider": "local", "mitigation": "Keep bound to localhost. Add authentication for network exposure.", "name": "LocalAI", "permission_scope": [ "network_access" ], "process_names": [ "local-ai" ], "risk_profile": "low", "risk_reason": "Self-hosted OpenAI-compatible API \u2014 local inference only" }, { "app_id": "ollama", "brew_names": [ "ollama", "ollama-app" ], "category": "local_llm", "cost_tier": "free", "data_egress": "none", "linux_paths": [ "/usr/local/bin/ollama", "/usr/bin/ollama" ], "llm_endpoints": [ "localhost:11434" ], "llm_provider": "local", "mac_paths": [ "/Applications/Ollama.app" ], "mitigation": "Keep Ollama bound to localhost (default). If using with LangChain/CrewAI, monitor the calling framework instead.", "name": "Ollama", "permission_scope": [ "network_access" ], "process_names": [ "Ollama", "ollama", "ollama.exe" ], "risk_profile": "low", "risk_reason": "Local inference only \u2014 no data leaves your machine by default. Risk increases if exposed on 0.0.0.0 or used by agentic frameworks", "win_paths": [ "{LOCALAPPDATA}/Programs/Ollama/ollama.exe" ] }, { "app_id": "open-webui", "category": "local_llm", "cli_commands": [ "open-webui" ], "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:3000", "localhost:8080", "localhost:11434" ], "llm_provider": "local", "mitigation": "Keep bound to 127.0.0.1. Enable authentication in Open WebUI settings. Don't expose port 3000/8080 on the firewall. Pin to a specific Ollama model to avoid accidental cloud API calls.", "name": "Open WebUI", "permission_scope": [ "network_access" ], "pip_packages": [ "open-webui" ], "process_names": [ "open-webui", "open_webui" ], "risk_profile": "medium", "risk_reason": "Web frontend for Ollama and OpenAI-compatible APIs \u2014 if not bound to localhost it exposes your local LLM (and any connected cloud APIs) to the network without authentication by default." }, { "app_id": "text-gen-inference", "category": "local_llm", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:8080" ], "llm_provider": "local", "mitigation": "Keep bound to localhost. Use authentication tokens for network access.", "name": "Text Generation Inference (HF)", "permission_scope": [ "network_access" ], "process_names": [ "text-generation-launcher", "text-generation-router" ], "risk_profile": "low", "risk_reason": "Hugging Face local model serving \u2014 optimized inference server" }, { "app_id": "vllm", "category": "local_llm", "cost_tier": "free", "data_egress": "none", "llm_endpoints": [ "localhost:8000" ], "llm_provider": "local", "mitigation": "Bind to localhost only. Add authentication if exposed on network.", "name": "vLLM", "permission_scope": [ "network_access" ], "pip_packages": [ "vllm" ], "risk_profile": "low", "risk_reason": "High-throughput local LLM serving \u2014 OpenAI-compatible API, no data egress" }, { "app_id": "agent-smith-offensive", "category": "offensive-security-agent", "cost_tier": "free", "data_egress": "cloud+local", "llm_endpoints": [ "api.openai.com", "api.anthropic.com", "localhost:11434" ], "llm_provider": "multi", "mitigation": "Flag immediately on detection regardless of declared purpose. Cross-reference egress against _PASSIVE_RECON_DESTINATIONS and _SUPPLY_CHAIN_DESTINATIONS (AWR-158, AWR-161). MCP tool-call patterns will match AWR-166 coherence mismatch for non-security agents.", "name": "Agent-Smith (0x0pointer)", "permission_scope": [ "network_access", "process_spawn", "docker_exec", "filesystem_read" ], "pip_packages": [ "agent-smith", "agent_smith_offensive" ], "risk_profile": "critical", "risk_reason": "LLM-driven autonomous attack path synthesis. Reads security skill descriptions and generates exploit chains via MCP tool calling. Docker-sandboxed but visible at network egress layer." }, { "app_id": "rewind-ai", "category": "os_ai", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.limitless.ai" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Rewind.app", "/Applications/Limitless.app" ], "mitigation": "Pause Rewind/Limitless during sensitive work (keyboard shortcut available). Exclude apps in Preferences \u2192 Excluded Apps. Disable microphone recording if not needed. Review OpenAI data retention for your queries.", "name": "Rewind / Limitless", "permission_scope": [ "network_access", "files_write", "camera_mic", "system_settings" ], "process_names": [ "Rewind", "Limitless", "rewind" ], "risk_profile": "critical", "risk_reason": "macOS app that continuously records your screen and microphone, compresses and stores locally, then uses GPT-4 to answer questions about your past activity. All summarisation queries go to OpenAI. Full screen content (including passwords, keys, proprietary docs) is captured." }, { "app_id": "windows-recall", "category": "os_ai", "cost_tier": "free", "data_egress": "local", "llm_endpoints": [ "api.cognitive.microsoft.com" ], "llm_provider": "microsoft", "mitigation": "Disable Recall in Windows Settings \u2192 Privacy & Security \u2192 Recall & Snapshots. Enterprise: use MDM policy (AllowRecall=0). Exclude sensitive apps via Recall's filter list. At minimum, enable the 'Require PIN to access Recall' setting.", "name": "Windows Recall (Copilot+)", "permission_scope": [ "files_write", "system_settings", "camera_mic" ], "process_names": [ "recall.exe", "SnippingTool.exe" ], "risk_profile": "critical", "risk_reason": "Windows 11 Copilot+ feature that takes a screenshot every few seconds and indexes everything visible on screen using a local NPU. The semantic index is stored unencrypted on disk and accessible to any process running as the user \u2014 including malware. Covers all apps, all windows, all typed text.", "win_paths": [ "{WINDIR}/System32/AIX/recall.exe", "{LOCALAPPDATA}/Microsoft/Windows/Recall/recall.exe" ] }, { "app_id": "adobe-acrobat-ai", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "acrobatservices.adobe.com", "dc-api.adobe.io" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Adobe Acrobat DC.app", "/Applications/Adobe Acrobat.app", "/Applications/Adobe Acrobat Reader.app", "/Applications/Adobe Acrobat Reader DC.app" ], "mitigation": "Disable AI features in Acrobat Preferences \u2192 AI. Enterprise admins can restrict AI services via ADMX policy (AdobeAcrobatAIServices=0). Avoid using AI Assistant with classified or PII-heavy documents.", "name": "Adobe Acrobat (AI Assistant)", "permission_scope": [ "network_access", "files_read" ], "process_names": [ "Acrobat", "AdobeAcrobat", "Acrobat.exe", "AcroRd32.exe", "AcroCEF.exe" ], "risk_profile": "medium", "risk_reason": "Adobe AI Assistant (available in Acrobat DC 2024+) can read and summarise entire PDF documents, including sensitive contracts, financial reports, and medical records \u2014 document text is sent to Adobe's cloud AI endpoints.", "win_paths": [ "{PROGRAMFILES}/Adobe/Acrobat DC/Acrobat/Acrobat.exe", "{PROGRAMFILES(X86)}/Adobe/Acrobat DC/Acrobat/Acrobat.exe", "{PROGRAMFILES}/Adobe/Acrobat Reader DC/Reader/AcroRd32.exe", "{PROGRAMFILES(X86)}/Adobe/Acrobat Reader DC/Reader/AcroRd32.exe", "{PROGRAMFILES}/Adobe/Adobe Acrobat/Acrobat.exe" ] }, { "app_id": "atlassian-rovo", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "atlassian.com", "atlassian.net", "api.atlassian.com" ], "llm_provider": "anthropic", "mac_paths": [ "/Applications/Jira.app", "/Applications/Confluence.app" ], "mitigation": "Enforce ACL inheritance \u2014 Rovo must respect per-page/per-issue permissions. Audit which connected sources are enabled. Restrict Rovo Agents creation to admins.", "name": "Atlassian Rovo", "permission_scope": [ "files_read", "network_access" ], "process_names": [], "risk_profile": "high", "risk_reason": "AI search + chat + agents across Jira / Confluence / Trello plus connected sources (Drive, Slack, GitHub). Reads everything the user can read. Browser-delivered primarily; no unique desktop process \u2014 detect via proxy traffic to *.atlassian.com with Rovo headers." }, { "app_id": "fathom", "category": "productivity", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "fathom.video", "api.fathom.video" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Fathom.app" ], "mitigation": "Enforce SSO. Disable public link sharing. Audit retention policy.", "name": "Fathom (Meeting AI)", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Fathom", "Fathom.exe" ], "risk_profile": "medium", "risk_reason": "Free-tier meeting AI growing in mid-market. Records Zoom + Meet + Teams. Transcripts + AI summaries shared via simple link \u2014 potential accidental disclosure vector.", "win_paths": [ "{LOCALAPPDATA}/Programs/Fathom/Fathom.exe" ] }, { "app_id": "fellow-ai", "category": "productivity", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "fellow.app", "api.fellow.app" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Fellow.app" ], "mitigation": "Audit Zapier integrations. Restrict by meeting type (no sensitive meetings auto-transcribed).", "name": "Fellow.ai", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Fellow", "Fellow.exe", "Fellow Helper" ], "risk_profile": "medium", "risk_reason": "AI meeting assistant with native Microsoft Teams integration (#1 for Teams per industry reviews). 8000+ Zapier app connections \u2014 broad downstream egress.", "win_paths": [ "{LOCALAPPDATA}/Programs/Fellow/Fellow.exe" ] }, { "app_id": "fireflies-ai", "category": "productivity", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "fireflies.ai", "api.fireflies.ai" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Fireflies.app" ], "mitigation": "Audit which integrations are enabled. Disable for meetings discussing PII, financials, or M&A. Review retention policy \u2014 Fireflies stores transcripts by default.", "name": "Fireflies.ai", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Fireflies", "Fireflies.exe", "Fireflies Helper" ], "risk_profile": "high", "risk_reason": "Cross-platform meeting AI (Zoom/Teams/Meet/Webex). Records, transcribes, summarizes. 50+ integrations feed meeting data into CRM and project tools \u2014 wide downstream egress.", "win_paths": [ "{LOCALAPPDATA}/Programs/Fireflies/Fireflies.exe" ] }, { "app_id": "glean", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "glean.com", "scio.glean.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Glean.app" ], "mitigation": "Enforce identity-mapped permissions \u2014 Glean must inherit per-user ACLs from each connected source. Audit which sources are indexed. Disable for highly-classified workspaces.", "name": "Glean (Enterprise Search)", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Glean", "Glean.exe", "Glean Helper" ], "risk_profile": "high", "risk_reason": "Enterprise search across 100+ workplace apps (Slack, Drive, Salesforce, Notion, GitHub, Confluence). Reads everything the user can read \u2014 effectively a superuser search index. Desktop app + Chrome extension.", "win_paths": [ "{LOCALAPPDATA}/Programs/Glean/Glean.exe" ] }, { "app_id": "grammarly", "category": "productivity", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.grammarly.com" ], "llm_provider": "grammarly", "mac_paths": [ "/Applications/Grammarly Desktop.app", "/Applications/Grammarly for Desktop.app" ], "mitigation": "Turn off GrammarlyGO rewrites for regulated workflows. Exclude sensitive apps in Grammarly settings.", "name": "Grammarly (AI Suite)", "permission_scope": [ "network_access", "files_read" ], "process_names": [ "Grammarly", "Grammarly Desktop" ], "risk_profile": "medium", "risk_reason": "Reads every text field you type into, including password fields in some contexts \u2014 sends text to Grammarly's cloud for suggestions and generative rewrites", "win_paths": [ "{LOCALAPPDATA}/Grammarly/DesktopIntegrations/Grammarly.Desktop.exe" ] }, { "app_id": "granola", "category": "productivity", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.granola.ai" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Granola.app" ], "mitigation": "Disable audio capture when not in meetings. Review which calls Granola is permitted to record. Check that participants are aware. Pause before discussions of trade secrets.", "name": "Granola", "permission_scope": [ "network_access", "camera_mic", "files_write" ], "process_names": [ "Granola" ], "risk_profile": "high", "risk_reason": "macOS meeting note-taker that captures system audio from ALL apps (including calls not in a browser) and sends transcripts to OpenAI GPT-4 for summarisation. Captures any audio output on the machine." }, { "app_id": "harvey-ai", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "harvey.ai", "app.harvey.ai", "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [], "mitigation": "Treat as a privileged-data channel. Require DLP review on every document uploaded. Restrict access by matter/case ID. Audit which documents each user uploaded.", "name": "Harvey AI", "permission_scope": [ "files_read", "files_write", "network_access" ], "process_names": [], "risk_profile": "critical", "risk_reason": "Legal AI used by top-tier law firms ($11B valuation, March 2026). Operates on privileged documents \u2014 contracts, due-diligence material, litigation prep. Browser-delivered; detect via proxy traffic to harvey.ai with attached document uploads." }, { "app_id": "hebbia", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "hebbia.com", "app.hebbia.com" ], "llm_provider": "multiple", "mac_paths": [], "mitigation": "Treat as a regulated-data channel. Require DLP review on every document. Restrict by deal/matter. Hash and log every upload for compliance retention.", "name": "Hebbia (Finance/Legal AI)", "permission_scope": [ "files_read", "files_write", "network_access" ], "process_names": [], "risk_profile": "critical", "risk_reason": "Finance and legal enterprise search on proprietary documents \u2014 investment memos, deal data, regulatory filings. Heavy-document workflows. Browser-delivered; detect via proxy traffic to hebbia.com with file uploads." }, { "app_id": "jamie-meetjamie", "category": "productivity", "cost_tier": "freemium", "data_egress": "selective", "llm_endpoints": [ "meetjamie.ai", "api.meetjamie.ai" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Jamie.app" ], "mitigation": "Verify the local-vs-cloud processing claim per plan tier. Audit retention.", "name": "Jamie (meetjamie.ai)", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Jamie", "Jamie.exe" ], "risk_profile": "medium", "risk_reason": "Privacy-first meeting AI \u2014 runs on the device, no meeting bot joining the call. Important for regulated industries. Lower egress than Fireflies/Fathom but transcripts still leave the device for AI processing.", "win_paths": [ "{LOCALAPPDATA}/Programs/Jamie/Jamie.exe" ] }, { "app_id": "microsoft-copilot", "category": "productivity", "cost_tier": "enterprise", "data_egress": "enterprise_cloud", "llm_endpoints": [ "graph.microsoft.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Microsoft Copilot.app" ], "mitigation": "Tenant admins can scope Copilot by role. Disable access to sensitive SharePoint sites.", "name": "Microsoft 365 Copilot", "permission_scope": [ "network_access", "files_read", "files_write" ], "process_names": [ "Microsoft Copilot", "Copilot.exe" ], "risk_profile": "medium", "risk_reason": "Reads mail, docs, calendar, and chats to generate and summarise \u2014 tenant-scoped but broad data access inside the scope", "win_paths": [ "{LOCALAPPDATA}/Microsoft/Copilot/Copilot.exe" ] }, { "app_id": "ms-copilot-studio", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "copilotstudio.microsoft.com", "powerplatform.microsoft.com" ], "llm_provider": "openai", "mac_paths": [], "mitigation": "Restrict who can publish Copilot Studio agents (admin policy). Audit which connectors each published agent uses. Monitor egress to graph.microsoft.com from agents.", "name": "Microsoft Copilot Studio", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "msedge", "msedge.exe" ], "risk_profile": "high", "risk_reason": "Microsoft's agent builder. Distinct from M365 Copilot \u2014 it lets users author custom agents that connect to internal data sources (SharePoint, Dataverse, Graph). Authored agents inherit author's data scope.", "win_paths": [ "{LOCALAPPDATA}/Microsoft/PowerPlatform/CopilotStudio" ] }, { "app_id": "teams-copilot", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "teams.microsoft.com", "graph.microsoft.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Microsoft Teams.app" ], "mitigation": "Disable Copilot for sensitive Teams channels. Enforce Data Boundary policies. Audit Copilot interaction logs in M365 admin center.", "name": "Microsoft Teams Copilot", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Microsoft Teams", "Teams", "Teams.exe", "ms-teams.exe", "MSTeams" ], "risk_profile": "high", "risk_reason": "Teams-specific surface of Microsoft Copilot \u2014 summarizes meetings, drafts replies, recaps chats. Distinct from M365 Copilot suite-level entry. Shares the Teams process; detect via Graph traffic with copilot scope headers.", "win_paths": [ "{LOCALAPPDATA}/Microsoft/Teams/current/Teams.exe" ] }, { "app_id": "notion-ai", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.notion.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Notion.app" ], "mitigation": "Admin workspaces can disable Notion AI at the workspace level. Audit which users have AI features enabled.", "name": "Notion (Notion AI)", "permission_scope": [ "network_access", "files_read" ], "process_names": [ "Notion" ], "risk_profile": "medium", "risk_reason": "Notion AI reads your workspace content to summarise, translate, and generate \u2014 page text is sent to Notion's LLM providers", "win_paths": [ "{LOCALAPPDATA}/Programs/Notion/Notion.exe" ] }, { "app_id": "obsidian-copilot", "category": "productivity", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Obsidian.app" ], "mitigation": "Review installed community plugins under Settings \u2192 Community plugins. Plugins can be disabled per-vault.", "name": "Obsidian (AI plugins)", "permission_scope": [ "network_access", "files_read" ], "process_names": [ "Obsidian" ], "risk_profile": "medium", "risk_reason": "Community AI plugins (Copilot, Smart Connections, Text Generator) can send note contents to third-party LLMs", "win_paths": [ "{LOCALAPPDATA}/Programs/Obsidian/Obsidian.exe" ] }, { "app_id": "otter-ai", "category": "productivity", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "api.otter.ai", "otter.ai" ], "llm_provider": "otter", "mac_paths": [ "/Applications/Otter.app", "/Applications/Otter.ai.app" ], "mitigation": "Notify all meeting participants before recording. Opt out of AI training in Settings \u2192 Privacy. Disable auto-join for calendar meetings. Use Business plan for stricter data controls.", "name": "Otter.ai", "permission_scope": [ "network_access", "camera_mic", "files_write" ], "process_names": [ "Otter", "Otter.ai", "Otter.exe" ], "risk_profile": "high", "risk_reason": "Continuously records and transcribes meeting audio \u2014 full conversation transcript (including sensitive business discussions) is stored on Otter's cloud and used to train AI models unless opted out.", "win_paths": [ "{LOCALAPPDATA}/Programs/Otter/Otter.exe", "{LOCALAPPDATA}/Programs/Otter.ai/Otter.ai.exe" ] }, { "app_id": "read-ai", "category": "productivity", "cost_tier": "freemium", "data_egress": "cloud", "llm_endpoints": [ "read.ai", "api.read.ai" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Read AI.app" ], "mitigation": "Audit which integrations are connected. Disable inbox-read for users handling regulated correspondence.", "name": "Read AI", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Read AI", "Read AI.exe", "ReadAI" ], "risk_profile": "medium", "risk_reason": "Meeting + email AI. Reads inbox content (Gmail/Outlook integrations) in addition to meeting recordings. Broader scope than meeting-only competitors.", "win_paths": [ "{LOCALAPPDATA}/Programs/Read AI/Read AI.exe" ] }, { "app_id": "salesforce-agentforce", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.salesforce.com", "einstein.ai.salesforce.com" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/Salesforce.app" ], "mitigation": "Treat as a regulated-data egress channel. Audit which CRM objects each agent persona can read. Enforce Field-Level Security and Profile-based data access.", "name": "Salesforce Agentforce 360", "permission_scope": [ "files_read", "files_write", "network_access" ], "process_names": [ "Salesforce", "Salesforce.exe" ], "risk_profile": "high", "risk_reason": "Enterprise agent layer over Salesforce CRM. Reads every customer record + opportunity + case. Can autonomously update records and trigger workflows. Mostly browser-delivered; desktop CRM if installed touches the same data." }, { "app_id": "servicenow-now-assist", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "service-now.com" ], "llm_provider": "multiple", "mac_paths": [], "mitigation": "Apply ACL roles to which tables Now Assist can read. Disable for highly-classified HR/security records. Audit Now Assist response logs.", "name": "ServiceNow Now Assist", "permission_scope": [ "files_read", "network_access" ], "process_names": [], "risk_profile": "high", "risk_reason": "Native AI across the ServiceNow platform \u2014 ITSM, HR, procurement, security ops. Reads every ticket and asset record. Browser-delivered; no unique desktop process \u2014 detect via proxy traffic to *.service-now.com with model headers." }, { "app_id": "slack-ai", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "slack.com", "edgeapi.slack.com" ], "llm_provider": "anthropic", "mac_paths": [ "/Applications/Slack.app" ], "mitigation": "Disable Slack AI for channels containing PII/financials/M&A. Restrict 'Recap' and 'Search Answers' per channel access. Audit who can see AI-generated summaries.", "name": "Slack AI", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "Slack", "Slack Helper", "Slack Helper (Renderer)", "Slack Helper (GPU)", "slack" ], "risk_profile": "high", "risk_reason": "Salesforce-native AI inside Slack desktop. Reads channel history, threads, and DMs to summarize and answer. Shares the Slack process \u2014 AI activity not distinguishable from regular Slack at the process level (detect via traffic patterns to edgeapi.slack.com with AI feature headers).", "win_paths": [ "{LOCALAPPDATA}/slack/slack.exe" ] }, { "app_id": "zoom-ai-companion", "category": "productivity", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "zoom.us", "ai.zoom.us" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/zoom.us.app" ], "mitigation": "Enable account-level AI Companion governance. Restrict which meeting types record transcripts. Audit per-user usage in Zoom Admin Portal.", "name": "Zoom AI Companion / Zoomie", "permission_scope": [ "files_read", "network_access" ], "process_names": [ "zoom.us", "Zoom", "zoom", "Zoom.exe" ], "risk_profile": "high", "risk_reason": "Native AI inside Zoom Workplace. New 'Zoomie' agentic facilitator (March 2026) operates across Zoom Rooms, Meetings, Chat, and Zoom Phone. Massive install base \u2014 any enterprise on Zoom Workplace has this surface.", "win_paths": [ "{LOCALAPPDATA}/Zoom/bin/Zoom.exe" ] }, { "app_id": "anthropic-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.anthropic.com" ], "llm_provider": "anthropic", "mitigation": "Implement strict tool allowlists. Validate all tool inputs server-side. Use Anthropic's usage limits and monitor API spend. Sandbox tool execution.", "name": "Anthropic Python SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "anthropic" ], "risk_profile": "medium", "risk_reason": "Direct API access with tool use capability. Applications can define and execute arbitrary tools, including shell commands and file operations" }, { "app_id": "cohere-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.cohere.ai", "api.cohere.com" ], "llm_provider": "cohere", "mitigation": "Validate RAG outputs. Restrict connector access. Monitor usage.", "name": "Cohere SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "cohere" ], "risk_profile": "medium", "risk_reason": "Cohere API access with RAG and tool use capabilities" }, { "app_id": "deepseek-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.deepseek.com" ], "llm_provider": "deepseek", "mitigation": "Review data privacy policy. Consider data jurisdiction implications. Avoid for sensitive data.", "name": "DeepSeek SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "deepseek" ], "risk_profile": "medium", "risk_reason": "DeepSeek API \u2014 data jurisdiction concerns (China-based), cloud inference with tool use" }, { "app_id": "dspy", "category": "sdk", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Set compile-time API call budgets. Avoid running DSPy optimisation on sensitive data pipelines.", "name": "DSPy", "permission_scope": [ "network_access" ], "pip_packages": [ "dspy-ai", "dspy" ], "risk_profile": "medium", "risk_reason": "Stanford framework for programming LLM pipelines \u2014 optimises prompts and chains automatically by calling the LLM API many times during compilation." }, { "app_id": "fireworks-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.fireworks.ai" ], "llm_provider": "fireworks", "mitigation": "Monitor usage. Validate outputs.", "name": "Fireworks AI SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "fireworks-ai" ], "risk_profile": "medium", "risk_reason": "Fireworks AI API \u2014 cloud LLM inference with function calling support" }, { "app_id": "google-genai-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "generativelanguage.googleapis.com" ], "llm_provider": "google", "mitigation": "Validate function call outputs. Restrict API key permissions. Monitor usage.", "name": "Google GenAI SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "google-generativeai" ], "risk_profile": "medium", "risk_reason": "Google Gemini API access \u2014 function calling and code execution capabilities" }, { "app_id": "groq-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.groq.com" ], "llm_provider": "groq", "mitigation": "Monitor usage. Validate function call outputs.", "name": "Groq SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "groq" ], "risk_profile": "medium", "risk_reason": "Groq API access \u2014 high-speed LLM inference with function calling" }, { "app_id": "instructor-sdk", "category": "sdk", "cost_tier": "free", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com", "api.anthropic.com" ], "llm_provider": "multiple", "mitigation": "Ensure correct provider is configured. Don't pass PII or secrets in structured extraction calls. Monitor API usage.", "name": "Instructor (structured outputs)", "permission_scope": [ "network_access" ], "pip_packages": [ "instructor" ], "risk_profile": "medium", "risk_reason": "Structured LLM output library \u2014 commonly used in production pipelines and agentic systems. Patches the OpenAI/Anthropic client, so any data passed to it goes to the configured provider." }, { "app_id": "mistral-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.mistral.ai" ], "llm_provider": "mistral", "mitigation": "Validate function call parameters. Monitor API spend.", "name": "Mistral AI SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "mistralai" ], "risk_profile": "medium", "risk_reason": "Mistral API access with function calling support" }, { "app_id": "openai-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mitigation": "Validate and sanitize all function call parameters. Use OpenAI's moderation API for user-facing apps. Implement rate limiting and cost caps on API keys.", "name": "OpenAI Python SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "openai" ], "risk_profile": "medium", "risk_reason": "Direct API access with function calling capability. Applications built with this SDK can execute arbitrary tool calls depending on implementation" }, { "app_id": "replicate-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.replicate.com" ], "llm_provider": "replicate", "mitigation": "Review model permissions. Monitor usage and costs.", "name": "Replicate SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "replicate" ], "risk_profile": "medium", "risk_reason": "Cloud model hosting \u2014 runs arbitrary ML models on Replicate infrastructure" }, { "app_id": "together-sdk", "category": "sdk", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.together.xyz" ], "llm_provider": "together", "mitigation": "Monitor model usage and costs. Validate outputs.", "name": "Together AI SDK", "permission_scope": [ "network_access" ], "pip_packages": [ "together" ], "risk_profile": "medium", "risk_reason": "Together AI API \u2014 runs open-source models in cloud with function calling" }, { "app_id": "elevenlabs-sdk", "category": "voice", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.elevenlabs.io" ], "llm_provider": "elevenlabs", "mitigation": "Don't use with sensitive text content. Review voice cloning consent requirements.", "name": "ElevenLabs SDK", "permission_scope": [ "network_access", "camera_mic" ], "pip_packages": [ "elevenlabs" ], "risk_profile": "medium", "risk_reason": "Cloud text-to-speech and voice cloning \u2014 sends text and audio data to ElevenLabs servers" }, { "app_id": "krisp", "category": "voice", "cost_tier": "freemium", "data_egress": "selective", "llm_endpoints": [ "krisp.ai", "api.krisp.ai" ], "llm_provider": "multiple", "mac_paths": [ "/Applications/krisp.app" ], "mitigation": "Disable transcript upload if local-only is required. Audit per-meeting whether transcripts left the device.", "name": "Krisp (AI Voice/Transcription)", "permission_scope": [ "network_access" ], "process_names": [ "krisp", "Krisp", "Krisp.exe" ], "risk_profile": "medium", "risk_reason": "AI noise cancellation + meeting transcription. Sits in the audio stack between OS and meeting apps \u2014 sees every call. Local processing for noise cancel, but transcripts can route to cloud.", "win_paths": [ "{LOCALAPPDATA}/Programs/Krisp/Krisp.exe" ] }, { "app_id": "whisper", "category": "voice", "cli_commands": [ "whisper" ], "cost_tier": "free", "data_egress": "none", "llm_endpoints": [], "llm_provider": "local", "mitigation": "No mitigation needed for local use.", "name": "OpenAI Whisper", "permission_scope": [ "camera_mic" ], "pip_packages": [ "openai-whisper" ], "risk_profile": "low", "risk_reason": "Local speech-to-text \u2014 runs entirely on your machine, no cloud connection" }, { "app_id": "superwhisper", "category": "voice", "cost_tier": "paid", "data_egress": "cloud", "llm_endpoints": [ "api.openai.com" ], "llm_provider": "openai", "mac_paths": [ "/Applications/Superwhisper.app" ], "mitigation": "Use local Whisper mode (no egress). Disable cloud rewriting for sensitive dictation. Review microphone permissions.", "name": "Superwhisper", "permission_scope": [ "network_access", "camera_mic" ], "process_names": [ "Superwhisper" ], "risk_profile": "medium", "risk_reason": "System-wide voice dictation that transcribes microphone input and optionally rewrites text via GPT-4. Microphone audio and transcripts sent to OpenAI for cloud-mode transcription." } ], "count": 133, "disclaimer": "What AariaSec recognises. Detection happens via static signals (process names + bundle paths) AND runtime LLM-endpoint traffic; an agent NOT in this list can still be caught on the traffic side.", "generated_at": "2026-07-30T17:57:26Z", "schema_version": 1 }