[security-observability] Daily Security Observability Report — 2026-09-05

[github-actions[bot]]

Executive Summary

Over the last 7 days, 88 of 100 firewall-enabled agentic workflow runs were successfully audited, generating 4,268 monitored network requests. The block rate was moderate at 7.4% (314 blocked requests), concentrated on a small set of 9 unique domains — dominated by api.github.com (235 blocks, mostly rate-limit or scope related from Daily Go Test Parallelizer and PR Sous Chef) and ab.chatgpt.com (26 blocks, a telemetry/analytics endpoint not on the allowlist).

Separately, the DIFC (Data Integrity and Flow Control) system filtered 1,189 tool calls across 29 audited runs, nearly all (1,187 / 99.8%) due to agents attempting to read GitHub issues/PRs below their required integrity threshold (unapproved:public content). Activity spiked sharply on 2026-09-05 (604 events), driven largely by Smoke Agent: public/approved (233), Workflow Normalizer (209), and Daily Assign Issue To User (180) — all using the github MCP server via list_issues/search_issues calls that returned untrusted content.

No single workflow appears prominently in both signals, suggesting the firewall blocks (network egress control) and DIFC filtering (content integrity control) are addressing largely independent risk surfaces today — network allowlist gaps vs. content provenance gating on issue/PR data.

---

🔥 Firewall Analysis

Key Firewall Metrics

Metric	Value
Workflows analyzed (firewall-enabled)	88
Total network requests monitored	4,268
✅ Allowed requests	3,954
🚫 Blocked requests	314
Block rate	7.36%
Total unique blocked domains	9

📈 Firewall Request Trends

All audited activity clustered on 2026-09-05 due to log retention/scheduling of the audited run set; blocked requests represent a small consistent fraction (~7%) of total traffic, without any dramatic spike pattern.

Top Blocked Domains

api.github.com accounts for the large majority of blocks (235/314, 75%), primarily from Daily Go Test Parallelizer and PR Sous Chef — likely GitHub API calls made outside the expected proxy/allowlist path rather than malicious activity. ab.chatgpt.com (an OpenAI telemetry domain) is blocked consistently, suggesting it should either be explicitly allowlisted or confirmed as intentionally denied telemetry.

Most Frequently Blocked Domains

Domain	Times Blocked	Workflows	Category
api.github.com:443	235	Daily Go Test Parallelizer, PR Sous Chef	GitHub API
ab.chatgpt.com:443	26	Daily Go Test Parallelizer, GitHub API Consumption Report Agent, Issue Monster	Telemetry/Analytics
github.com:443	20	Daily Go Test Parallelizer, Daily Malicious Code Scan Agent, PR Code Quality Reviewer	GitHub Web
(unknown)	16	Agent Performance Analyzer, Agent Persona Explorer, Auto-Triage Issues	Unresolved/DNS
pypi.org:443	6	Daily Go Test Parallelizer	Package Registry
cafe.github.com:443	3	Daily Go Test Parallelizer	GitHub Internal
raw.githubusercontent.com:443	3	Daily Go Test Parallelizer	GitHub Content CDN
api.anthropic.com:443	3	Claude Code User Documentation Review, [aw] Failure Investigator (6h)	AI Model API
storage.googleapis.com:443	2	Delight	Cloud Storage

Policy Rule Attribution

Detailed per-rule hit/deny attribution was not returned by the audit tool for these runs (empty rule_hits/denied_requests). Observed policy configurations across the sample:

📋 Policies observed: 7 rules, SSL Bump disabled, DLP disabled; 9 rules, SSL Bump disabled, DLP disabled; 10 rules, SSL Bump disabled, DLP disabled; 11 rules, SSL Bump disabled, DLP disabled (varying by workflow's declared network permissions).

View Detailed Request Patterns by Workflow

The heaviest blocked-domain contributors were Daily Go Test Parallelizer (appears across 6 of the 9 blocked domains — api.github.com, ab.chatgpt.com, github.com, pypi.org, cafe.github.com, raw.githubusercontent.com) and PR Sous Chef (api.github.com). Twelve runs could not be audited due to audit-tool timeouts (context deadline exceeded): 33963266095, 33972429854, 33971903697, 33966878792, 33971894411, 33966115026, 33958079621, 33966934813, 33968767006, 33966410850, 33958724638, 33974812758.

View Complete Blocked Domains List

(unknown), ab.chatgpt.com:443, api.anthropic.com:443, api.github.com:443, cafe.github.com:443, github.com:443, pypi.org:443, raw.githubusercontent.com:443, storage.googleapis.com:443

🔒 Firewall Security Recommendations

1. Investigate why Daily Go Test Parallelizer and PR Sous Chef are hitting api.github.com outside the allowed path — this is likely a direct API call bypassing the intended GitHub MCP/tool proxy, and may indicate a network permission misconfiguration rather than malicious traffic.
2. Decide explicitly whether ab.chatgpt.com (OpenAI telemetry) should be allowlisted for workflows using OpenAI-backed engines, or confirm the block is intentional policy.
3. Resolve the 16 "(unknown)" blocked domain entries — likely DNS resolution failures or SNI-stripped requests; investigate if these indicate misbehaving egress attempts.
4. pypi.org, raw.githubusercontent.com, and cafe.github.com blocks in Go test workflows suggest package/dependency fetches may need explicit network permission grants if legitimate.
5. Re-run audits for the 12 timed-out workflow runs with a longer timeout window to ensure full 7-day coverage in future reports.

---

🔒 DIFC Integrity Analysis

Key DIFC Metrics

Metric	Value
Total filtered events	1,189
Unique tools filtered	8
Unique workflows affected	16
Most common filter reason	integrity_below_threshold (99.8%)
Busiest day	2026-09-05 (604 events)

📈 DIFC Events Over Time

Filtering activity is uneven across the week: 354 events on 2026-09-01, dropping to 61 on 2026-09-02, rising to 170 on 2026-09-03, with no events recorded on 2026-09-04, then a sharp spike to 604 on 2026-09-05 — the day of this report's run. The spike aligns with the increased cadence of Smoke Agent and Workflow Normalizer runs on that day.

🔧 Top Filtered Tools

list_issues (757) and search_issues (406) together account for 98% of all filtered calls — both are broad, unscoped GitHub search/listing operations that inherently surface community-authored (untrusted) issue content, which frequently fails the agent's integrity requirement of "approved" provenance.

🏷️ Filter Reasons and Tags

Nearly all filtering (99.8%) stems from integrity threshold violations rather than secrecy; the dominant tags are none:public (1,189 occurrences) and unapproved:public (797), confirming that most filtered content is untrusted public-repo issue/PR data lacking maintainer approval — exactly the class of content these agents are designed to avoid ingesting directly.

📋 Per-Workflow DIFC Breakdown

Workflow	Filtered Events
Smoke Agent: public/approved	233
Workflow Normalizer	209
Daily Assign Issue To User	180
Sub-Issue Closer	154
Dev	150
Agent Performance Analyzer - Meta-Orchestrator	90
Smoke Temporary ID	77
GitHub Remote MCP Authentication Test	26
Smoke Agent: all/merged	26
Issue Triage Agent	23
Smoke Agent: scoped/approved	6
Daily Regression Audit	5
Daily Spec Coverage Review	5
GitHub MCP Structural Analysis	3
Code Scanning Fixer	1
Daily Evals Feature Report	1

📋 Per-Server DIFC Breakdown

MCP Server	Filtered Events
github	1,189

👤 Per-User DIFC Breakdown

Author Login	Filtered Events
unknown	1,071
lpcox	13
yskopets	11
dsyme	7
v1v	7
JamesNK	4
bbonafed	4
loganrosen	4
ilja	4
kkruel8100	4
benissimo	3
theletterf	3
praveenkuttappan	2
lfgcampos	2
MH0386	2

💡 DIFC Tuning Recommendations

1. Review list_issues/search_issues usage patterns in Smoke Agent: public/approved, Workflow Normalizer, and Daily Assign Issue To User — these workflows generate the bulk of filtering by repeatedly searching/listing issues that return unapproved public content. Consider narrowing search scope (labels, authors, state) to reduce noise, or confirm the filtering is working as intended (blocking untrusted content from reaching the agent).
2. Investigate the 2026-09-05 spike (604 events, over 3x the daily average) — correlate with any workflow schedule changes, new triggers, or a broader issue-search pattern introduced that day.
3. The two secrecy_violation events (get_code_scanning_alert, get_file_contents) indicate an agent attempted to access private-scoped data without authorization — investigate the specific run and workflow permissions to ensure this wasn't a misconfigured private-repo grant.
4. 1,071 events have unknown author — investigate whether this is expected (e.g., scheduled/system-triggered searches with no single triggering actor) or a gap in author-association tracking that should be fixed for better attribution.
5. Two runs (33950080034, 33947355268) could not be audited due to timeouts — re-run with extended timeout for complete 7-day DIFC coverage.

---

Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer)
Analysis window: Last 7 days | Repository: github/gh-aw
Run: https://github.com/github/gh-aw/actions/runs/33976148518

Generated by 🔒 Daily Security Observability Report · copilot · auto · 113.9 AIC · ⌖ 9.96 AIC · ⊞ 15.3K · ◷

• expires on Sep 8, 2026, 8:25 AM UTC-08:00