AI Safety — Unsafe Mode Detection

Plan requirement

Unsafe events and Config Guard compliance data require the Starter plan or above, and are included in the 14-day trial.

The AI Safety dashboard page monitors unsafe AI tool usage across all endpoints. It covers three distinct detection mechanisms:

1. Config Guard compliance — Is the Config Guard file present and unmodified on every endpoint?
2. Unsafe config events — Did any AI tool have dangerous config settings enabled (e.g. Cursor dangerouslyAllowArbitraryCode, or bypassPermissions in a user's Claude Code settings)?
3. Unsafe process attempts — Was an AI tool started with an unsafe CLI flag, or is it running as root?

Process-level detection

Sielum monitors running AI processes for dangerous CLI flags, across every supported tool:

Tool	Flags
Claude Code	--dangerously-skip-permissions, --no-rate-limit-bypass-check, --allowedTools *, --allowedTools all
Cursor	--disable-web-security, --allow-running-insecure-content, --proxy-bypass-list=*
GitHub Copilot	--proxy-bypass, --insecure
Amazon Q	--no-verify-ssl, --disable-ssl-verification
Windsurf	--disable-web-security, --proxy-bypass-list=*
Gemini CLI	--no-verify-ssl, --skip-ssl-verification, --no-sandbox

These flags either disable the tool's own permission checks or strip away transport security, which is what makes them worth an audit trail.

Privilege escalation

Independently of any flag, Sielum reports an AI tool running as root (Linux and macOS) as root-execution. The dashboard ranks it Critical: an agent with root has no meaningful permission boundary left, whatever its own configuration says.

No process killing

Sielum does not kill processes. When Claude Code's Managed Settings are configured, Claude Code itself rejects the --dangerously-skip-permissions flag before executing. Sielum only logs the attempt as an audit trail.

Every detected attempt is logged with timestamp, endpoint, process name, PID, and the exact flag used. A high-severity alert is created in the Alerts page.

Config-level detection and remediation

On every tick the agent scans the AI tools' own config files for dangerous settings. What happens with a finding depends on the endpoint's enforcement mode:

• audit (the default) — the finding is reported and the file is left untouched, so the event carries remediated: false
• enforce — the file is corrected in place and the event carries remediated: true

Set the mode per device on the Devices page in the dashboard; the default for a freshly installed agent is audit.

Cursor — ~/.cursor/mcp.json

Config	Risk	Sielum action in enforce mode
dangerouslyAllowArbitraryCode: true (root-level)	Allows arbitrary code execution by MCP servers	Set to false
dangerouslyAllowArbitraryCode: true (per-server)	Same, scoped to one MCP server	Set server disabled: true + flag to false

Claude Code — ~/.claude/settings.json

Config Guard governs the machine-wide managed settings file. This check covers what a user writes into their own settings file, which is where a permission bypass is most likely to appear in practice:

Config	Risk	Sielum action in enforce mode
permissions.defaultMode: "bypassPermissions"	All permission prompts skipped for that user	Reset to "default"
bypassPermissions: true (legacy top-level key)	Same, older Claude Code versions	Set to false
permissions.allow contains "*"	Every tool allowed without restriction	Wildcard entry removed
MCP servers outside the Config Guard allow-list	Unapproved MCP server usable by the tool	Server set to disabled: true (only when Allow Managed MCP Servers Only is enabled)

Gemini CLI and GitHub Copilot

The agent also reports non-corporate usage patterns it can read from the tools' configuration, for example a custom (non-vendor) API endpoint, a personal authentication type, or a personal access token used instead of the organization's SSO login. These surface as unsafe config events and in the Security Issues view.

Remediation is atomic (write-to-temp + rename) to avoid partial-write corruption, and file ownership is preserved when the agent writes into a user's home directory on their behalf.

Dashboard — AI Safety page

Navigate to AI Safety in the sidebar, under Activity. The page is admin-only and requires the Starter plan or above. The page has three tabs:

Tab	What it shows
Config Guard	Compliance summary for all endpoints (compliant/non-compliant/tamper type)
Unsafe Config Events	Every detected dangerous config setting, with timestamp, endpoint, tool, path, violation, and whether it was remediated
Unsafe Process Attempts	Detected dangerous CLI flags and root execution, with timestamp, endpoint, process name, PID, and flag

All tabs update live via WebSocket.

24h event badge

A red badge in the page header shows the total number of unsafe events (config + process) in the last 24 hours at a glance.