Skip to main content

AI Security pack

The AI Security pack finds the AI tools, models, agents and MCP servers in use in your organisation, and helps you hunt for AI misuse. It takes stock of the AI on your endpoints, adds the queries for your AI platforms, and brings hunts for AI-related attacks. It's an optional content pack: Huntbase makes it available to your organisation, and it runs only once an organisation admin enables it.

Use it to answer questions like "which machines run a local LLM?", "which MCP servers have people added to their AI tools?" and "which AI browser extensions can read every page?".

Rolling out

Content packs are currently rolling out and may not be enabled for your organisation.

At a glance​

PublisherHuntbase
Version1.1.1
Built onHuntbase core, Endpoint inventory and Endpoint response (all always on)
Needs these sourcesAny one of Huntbase Endpoint Control, Anthropic or OpenAI
What runs with RecommendedSix endpoint inventories on your Endpoint Control connections, and one watcher
Report templateAI security review
LicenceHuntbase content licence

What's in it​

Endpoint inventories​

Six osquery inventories that run on your endpoints through Endpoint Control. They work on macOS, Linux and Windows.

InventoryRunsWhat it finds
MCP Server Configuration FilesEvery 3 hoursEach user's MCP configuration files for common AI clients, such as Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI and Codex, with the file's owner, modification time and hash. A new or changed hash shows that an MCP server was added or edited. Project-level files inside repositories aren't covered.
Running MCP Server ProcessesEvery 6 hoursProcesses that look like MCP servers, with their command line, user and the AI client that started them. Use it with the configuration files inventory to see which servers actually start.
Local LLM RuntimesEvery 6 hoursLocal model runtimes such as Ollama, LM Studio, llama.cpp, vLLM, Msty and AnythingLLM, with their listening ports. It flags runtimes listening on all interfaces, which expose the model to the network.
Local AI Model FilesEvery 12 hoursGGUF, safetensors and GGML model files in the Hugging Face cache, LM Studio and GPT4All model folders and users' Downloads folders, with size and modification time. It looks only at fixed folder depths and doesn't hash files.
AI Coding Assistant IDE ExtensionsEvery 6 hoursAI coding assistant extensions in VS Code-family editors (including Cursor and Windsurf), such as GitHub Copilot, Claude Code, Cline and Continue, with their versions.
AI Browser ExtensionsEvery 6 hoursBrowser extensions named as AI assistants in Chromium browsers and Firefox, with the permissions each one asks for. Matching is by name, so check unfamiliar results.

Results are available in the query workspace, and to Scout, your investigation partner. You can change an inventory's schedule for your organisation.

Watcher​

MCP server run from an unpinned remote source notices an AI client starting an MCP server straight from a git repository, a GitHub shorthand or a raw file URL, or connecting to an MCP server over plain HTTP. Such a server runs with the user's rights and its code can change between launches. The watcher reads process activity from your endpoints and other process-creation sources. When it matches, it generates a detection. Recommended turns it on in digest mode. You can change its hunt mode, severity and what happens when it matches by customising it.

AI platforms​

  • Anthropic and OpenAI integrations, with all their query templates. See OpenAI.
  • Query templates for AWS Bedrock (agents, models, guardrails and knowledge bases), Google Vertex AI (endpoints, models and notebook runtime templates) and Azure AI services (including Azure OpenAI), run through your existing AWS, Google Cloud and Azure connections.

These are Library content: run them as query templates or let Scout use them. They don't run on a schedule.

Hunt playbooks​

Ten hunts from Huntbase Hub covering AI-assisted intrusion, abuse of AI coding agents (including tampering with their configuration and auditing their tool calls), exposed AI gateways and orchestration tools, and shadow AI use. They're in the Library and run only when you or Scout start one.

Report template​

AI security review lays out a hunt report: the verdict first, then findings by asset class, evidence, coverage gaps and recommendations. Hunts can use it while the pack is enabled.

Before you enable it​

  • Check it's available. If the pack page says Ask your Huntbase administrator to make this pack available, contact Huntbase.
  • Connect a source. The endpoint inventories need Endpoint Control with endpoints reporting. The Anthropic and OpenAI templates need a connection to that platform, and the Bedrock, Vertex AI and Azure templates use your cloud connections. You can enable the pack first: items without a source show Waiting for a source and start on their own once you connect one.
  • Check the preview. The enable dialog shows how many scheduled inventories and watchers the preset turns on, the connections they run on and roughly how many runs a day they add.

Enable it​

  1. Choose the organisation in the Scope selector. You need to be an organisation admin, or have Content packs: Manage for this pack.
  2. Open Library › Packs › AI Security and click Enable.
  3. Keep Recommended to run the six inventories and the watcher, or choose Everything or Library only.
  4. Click Enable pack.

Inventory results arrive after each endpoint's next scheduled run. See Enable a pack for the full flow.

What it may do​

The Licence and trust tab lists what the pack may do. AI Security:

  • runs read-only queries against your connections and endpoints;
  • may propose endpoint actions, which ask for approval before they run. Enabling the pack never runs an action.

The pack and its Hub hunts are published by Huntbase under Huntbase's content licence.

Work with the results​

  • Ask Scout "which endpoints run a local LLM?" or "which MCP servers are configured on our laptops?".
  • Start one of the pack's hunts from the Library, for example when an inventory turns up an MCP server or AI extension you don't recognise.
  • Switch individual inventories off, or change how often they run, on the Contents tab.

Updates​

Updates follow the pack's update policy. Version 1.1 added the Local AI Model Files inventory and the watcher, ran MCP Server Configuration Files more often, and removed the AI Coding Assistant JetBrains Plugins inventory. If you customised that inventory, the update review asks whether to keep it as your own or remove it. See the pack's Changelog tab for details.

Disable it​

Open the pack and click Disable. Its inventory schedules are paused and its watcher stops. Your switches and customised items are kept for when you enable it again, and results and hunts stay. See Disable a pack.

Next steps​