[security-observability] Daily Security Observability Report — 2026-09-03

[github-actions[bot]]

Executive Summary

Over the last 7 days, 89 firewall-enabled workflow runs across github/gh-aw generated 5,120 monitored network requests with a low 1.4% block rate (72 blocked / 5,048 allowed). Blocking activity was concentrated on a small set of 8 unique domains, led by ab.chatgpt.com:443 (23 blocks across 8 different workflows) — likely reflecting workflows that inadvertently probe or reference OpenAI-branded endpoints not on their allowlist — and api.anthropic.com:443 (5 blocks across 4 Claude-related workflows), which may indicate legitimate traffic that needs an allowlist update rather than a security concern.

On the DIFC (Data Integrity and Flow Control) side, 585 tool calls were filtered across 10 workflows in the last 7 days, overwhelmingly from list_issues (399) and search_issues (162) calls against the github MCP server. 559 of 585 events (96%) were blocked because the resource's integrity label fell below the approved threshold, with the remaining 26 blocked below merged. Filtering activity was heavily concentrated in Smoke Agent: public/approved (233 events) and Workflow Normalizer (189 events) — both smoke-test/validation workflows exercising integrity boundaries by design, suggesting most of this volume is expected test traffic rather than a signal of active attacks.

A cross-cutting theme: neither dataset shows evidence of successful exfiltration or policy bypass — firewall blocks are low-volume and DIFC filtering is dominated by expected validation workflows. The main opportunities are allowlist hygiene (Anthropic/OpenAI domains) and continued monitoring of the small number of non-test workflows (Issue Triage Agent, GitHub Remote MCP Authentication Test) that also triggered DIFC filtering, to confirm they are not attempting to read unapproved content as part of real task execution.

---

🔥 Firewall Analysis

Key Firewall Metrics

Metric	Value
Workflows analyzed (firewall-enabled)	89
Total network requests monitored	5,120
✅ Allowed requests	5,048
🚫 Blocked requests	72
Block rate	1.41%
Total unique blocked domains	8

📈 Firewall Request Trends

Available audit data for this window clusters on 2026-09-03 (the most recent day with retrievable firewall logs across all analyzed runs); allowed traffic (5,048 requests) vastly outweighs blocked traffic (72 requests), consistent with a healthy firewall posture where legitimate MCP/API/network calls dominate and blocks represent edge cases rather than systemic denial issues.

Top Blocked Domains

ab.chatgpt.com:443 and api.anthropic.com:443 account for the majority of blocks (28 of 72, ~39%) and both appear across multiple unrelated workflows, suggesting these are either mis-scoped allowlists for AI-model-adjacent workflows or benign SDK/telemetry calls that should be explicitly allowlisted rather than silently blocked. The remaining blocked domains (github.com, api.github.com, registry.npmjs.org, proxy.golang.org, storage.googleapis.com) each appear only 1–3 times and look like incidental, low-risk blocks tied to specific tooling (npm/Go module fetches, GCS artifacts).

Most Frequently Blocked Domains

Domain	Times Blocked	Workflows	Category
ab.chatgpt.com:443	23	AI Moderator, Daily Credit Limit Test, Daily Go Test Parallelizer, GitHub API Consumption Report Agent, Issue Monster, Ponytail Reviewer, PureLock, Workflow Normalizer	AI/LLM endpoint
api.anthropic.com:443	5	Claude Code User Documentation Review, Deep Report, GitHub MCP Structural Analysis, [aw] Failure Investigator (6h)	AI/LLM endpoint
github.com:443	3	Daily Malicious Code Scan Agent, PR Sous Chef, Test Quality Sentinel	GitHub
registry.npmjs.org:443	1	Impeccable Skills Reviewer	Package registry
proxy.golang.org:443	1	Daily Malicious Code Scan Agent	Package registry
api.github.com:443	1	Daily Issues Report Generator	GitHub API
storage.googleapis.com:443	1	Delight	Cloud storage

No policy_analysis.rule_hits data was available in any of the 97 successfully audited runs this cycle (rule-level attribution reported empty). Latest observed policy configuration: 11 rules, SSL Bump disabled, DLP disabled.

View Detailed Request Patterns by Workflow

97 of 98 firewall-enabled runs were successfully audited this cycle (1 run, 33773083361 — Avenger, could not be retrieved after repeated attempts and is excluded from these totals). Request volume and blocking activity were broadly distributed; no single workflow dominated blocked traffic — the highest-blocking domain (ab.chatgpt.com) was spread across 8 distinct workflows rather than concentrated in one, which is a good sign against a single malicious/misconfigured workflow being responsible.

View Complete Blocked Domains List

• ab.chatgpt.com:443
• api.anthropic.com:443
• api.github.com:443
• github.com:443
• proxy.golang.org:443
• registry.npmjs.org:443
• storage.googleapis.com:443

🔒 Firewall Security Recommendations

1. Allowlist AI-endpoint domains where legitimate: If ab.chatgpt.com and api.anthropic.com traffic is expected for AI Moderator, Deep Report, Claude Code User Documentation Review, and similar engine-related workflows, add them to the network allowlist for those specific workflows rather than blocking them repeatedly.
2. Investigate ab.chatgpt.com in non-AI workflows: Workflows like Daily Credit Limit Test, Daily Go Test Parallelizer, and PureLock blocking this domain suggests it may be an SDK default/telemetry call unrelated to their stated purpose — worth confirming this isn't unexpected outbound traffic.
3. Package registry access for Impeccable Skills Reviewer and Daily Malicious Code Scan Agent: If these workflows need npm/go module resolution, add registry.npmjs.org / proxy.golang.org to their allowlists explicitly.
4. No rule-level attribution available: Consider enabling policy_analysis.rule_hits reporting (if supported by the firewall configuration) to get per-rule denial counts in future audits for more precise tuning.

---

🔒 DIFC Integrity Analysis

Key DIFC Metrics

Metric	Value
Total filtered events	585
Unique tools filtered	6
Unique workflows affected	10
Most common filter reason	Resource integrity below "approved" (559 events, 96%)
Busiest day	2026-09-01 (354 events)

📈 DIFC Events Over Time

Filtering activity peaked on 2026-09-01 (354 events) then dropped to 61 on 2026-09-02 before rising again to 170 on 2026-09-03. This pattern tracks smoke-test workflow scheduling rather than a sustained upward trend — no evidence of an escalating attack pattern, but the day-to-day volatility suggests filtering volume is driven by scheduled validation runs rather than steady organic traffic.

🔧 Top Filtered Tools

list_issues (399) and search_issues (162) together account for 96% of all filtered calls — both are read-oriented GitHub tools that enumerate or search issues, which naturally surface many unapproved/public-integrity resources when scanning a large open-source repo like github/gh-aw. search_repositories (12), list_pull_requests (9), search_code (2), and issue_read (1) round out the remainder at low volume.

🏷️ Filter Reasons and Tags

96% of filtered events (559/585) were blocked because content fell below the approved integrity threshold, with the remaining 4% (26/585) below merged. On tags, none:public was present on all 585 events (baseline tag for public GitHub content), unapproved:public on 412 events (70%), and approved:public on only 14 events (2%) — reinforcing that the filter is doing its job of separating unvetted public content from approved content before it reaches agent reasoning. No secrecy_tags were present in this window, indicating none of the filtered events involved secret/credential-labeled content.

📋 Per-Workflow DIFC Breakdown

Workflow	Filtered Events
Smoke Agent: public/approved	233
Workflow Normalizer	189
Smoke Temporary ID	77
Smoke Agent: all/merged	26
Issue Triage Agent	23
GitHub Remote MCP Authentication Test	21
Smoke Agent: scoped/approved	6
Daily Spec Coverage Review	5
GitHub MCP Structural Analysis	3
Daily Regression Audit	2

📋 Per-Server DIFC Breakdown

MCP Server	Filtered Events
github	585

👤 Per-User DIFC Breakdown

Author Login	Filtered Events
unknown	562
v1v	5
ilja	4
kkruel8100	4
mouorad86-crypto	2
loganrosen	2
lpcox	2
massirr	2
MattSkala	1
GregoireW	1

💡 DIFC Tuning Recommendations

1. Treat Smoke Agent: public/approved, Smoke Temporary ID, Smoke Agent: all/merged, and Smoke Agent: scoped/approved (342 combined events, 58% of total) as expected baseline noise — these are dedicated smoke/validation workflows designed to exercise integrity boundaries, so their filtering volume should be excluded from anomaly-detection thresholds to avoid false-positive alerts.
2. Review Workflow Normalizer (189 events, 32%) — as a non-smoke-test workflow with high filtering volume, confirm whether it genuinely needs to enumerate large numbers of unapproved issues/PRs, or whether its list_issues/search_issues calls can be scoped more narrowly (e.g., filtered by label, state, or approved-content-only) to reduce unnecessary integrity-filtered reads.
3. Investigate the 562 events attributed to unknown author — the large majority of filtered events lack a resolved author_login. Confirm whether this is expected for scheduled/automated triggers (vs. actor-initiated runs) or indicates missing author-association metadata that should be backfilled for better attribution in future audits.
4. Monitor Issue Triage Agent and GitHub Remote MCP Authentication Test (23 and 21 events respectively) — these are task-oriented (non-smoke-test) workflows; periodically sample their filtered events to confirm the integrity gate is not blocking content genuinely needed for their triage/authentication logic.
5. No secrecy_tags were observed — if secrecy filtering is expected to be active for these workflows, verify the secrecy labeling pipeline is populating tags correctly; an empty result set may indicate the feature isn't yet exercised in this window rather than an absence of secret-labeled content.

---

Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer)
Analysis window: Last 7 days | Repository: github/gh-aw
Run: https://github.com/github/gh-aw/actions/runs/33775289585

Generated by 🔒 Daily Security Observability Report · copilot · auto · 154.3 AIC · ⌖ 20.5 AIC · ⊞ 15.3K · ◷

• expires on Sep 6, 2026, 8:41 AM UTC-08:00