Finding Ghost Agents: Detecting an AI Agent...

Last month, while running a scan against a client's production Kubernetes cluster, we found something that shouldn't exist. A Python process. Active network connections to api.openai.com and a Pinecone index. Execution every 4 minutes, consistent with an agent loop. No deployment manifest. No pod spec. No configmap. No source code anywhere in the repository. An AI agent — running in production — that no one on the team knew about. We call it a GHOST agent. It exists at runtime. It doesn't exist