H Hilt

Endpoint audit case 01

An AI coding CLI read 56 secret files. The gateway saw only 1.6 GB to Anthropic.

Hilt connected 213 reads across 56 unique secret files to Claude Code, four engineers, and the provider session. The gateway could see only aggregate encrypted traffic to an approved AI provider.

AI agents Govern AI access to sensitive data at runtime. macOS endpoints See file, process, clipboard, and transfer behavior. Book a walkthrough Investigate shadow AI against your own environment.

The finding

Four engineers used Claude Code inside a business deployment repository. One engineer generated 213 reads across 56 unique secret files, including secrets YAML files, environment files, defaults, and MCP client-credential modules.

What the stack saw

The gateway saw 1.6 GB uploaded to Anthropic over an expected encrypted connection. It could not determine whether source code, credentials, or ordinary prompts were inside.

What Hilt reconstructed

Hilt connected the exact process, four human owners, sensitive file paths, read count, and the provider session. That changed an ordinary provider connection into a concrete compliance review with a defensible response plan.