Companies integrating AI-driven development assistants (coding agents) face a transparency issue. The legal notices from various providers describe the formal data processing, but do not offer visibility on what and when is actually transmitted over the network during a programming session.
To address this need for governance and practical evidence, MC Project Lab defined AgentScoope: a local, repeatable, and controlled protocol to inspect the behavior of major development agents in a Windows environment.
The Monitoring Method
The AgentScoope method is based on tracking network traffic and local processes, operating in three phases within an isolated sandbox:
- Injection of Canary Files: Test workspace includes files containing fictitious secret strings (canary secrets) to detect if and when the agent reads or sends such information.
- Process Tracking: Detection of the subtree of subprocesses initiated by the agent to attribute connections and activities to the processes included in the test.
- TLS Inspection (MITM): When traffic passes through the test proxy, temporary decryption of connections to examine the content of the calls.
Recorded Evidence on Windows
Tests conducted on standardized programming tasks revealed different behaviors depending on the tool analyzed:
| Agent | Observed Evidence | Classification |
|---|---|---|
| Claude | 23 TLS streams, 14 payloads analyzed. Complete transmission of canary files to the official Anthropic endpoint (api.anthropic.com). | EXPECTED_FLOW |
| Codex (OpenAI) | 24 TLS streams, 10 payloads. Code and comments transmitted to chatgpt.com and official OpenAI endpoints. | EXPECTED_FLOW |
| Grok (0.2) | 63 TLS streams, 58 payloads. No canary files detected in outgoing traffic. | NO_MARKER |
| Antigravity | No inspectable streams due to local security restrictions. | NOT_INSPECTABLE |
| Kimi Code | TLS proxy active, but no streams or payloads captured. No canary found outside the sandbox and no changes to test files. | NOT_INSPECTABLE |
*Note: The term EXPECTED_FLOW indicates that project files were sent to the provider's servers. This is the ordinary and necessary behavior for the operation of a cloud assistant, not an illicit exfiltration. The real risk factor is transmission to third parties or poor local data management.
Kimi Code Test on July 26, 2026
The first check, conducted without decrypting HTTPS traffic, observed three remote endpoints connected to the Kimi process. One was 103.XXX.XX.XXX:443, belonging to a range registered in China according to APNIC RDAP data. RDAP is the official protocol used to query IP address assignment registries. The other addresses were registered to an Italian content distribution network and Cloudflare. This demonstrates a network connection to an address registered in China, but does not allow determining what data was transmitted. No canary appeared outside the sandbox and no workspace files were modified.
The test was then repeated with TLS proxy and temporary certificate. Kimi did not produce inspectable streams through the proxy: zero streams and zero payloads were recorded. The correct outcome is NOT_INSPECTABLE. The temporary CA was removed at the end, no canary was found in the checked caches or logs, and the sandbox was not modified.
Kimi Test Conclusion
No evidence of canary transmission emerged, but the result does not allow declaring that no data was sent. When traffic does not pass through the proxy, AgentScoope signals the limit instead of presenting the test as clean.
Implications for GDPR and AI Act
GDPR: the connection to an address registered in China alone does not prove that personal data was transferred and does not automatically constitute a violation. If code, logs, or other content with personal data are made available to an entity outside the European Economic Area, international transfer rules apply. China is not among the countries recognized by the European Commission as adequate.
Before using the service with personal data, the organization must verify what data is sent, where it is processed, who the subcontractors are, how long it is retained, and if there are valid safeguards. In the absence of an adequacy decision, standard contractual clauses, a transfer assessment, and supplementary measures may be required. When the provider processes data on behalf of the organization, the contract required by Article 28 of the GDPR must also be verified.
AI Act: a connection to China is not automatically prohibited. Obligations depend on the actual use of the system. An internal programming assistant does not automatically become a high-risk system; however, applicable obligations remain, including preparing staff for the conscious use of AI and, where applicable, transparency rules.
Prudential Rule
Until the data path and contractual guarantees are clarified, Kimi should not be used on projects containing personal data, client secrets, or confidential information. The test does not prove a data leak but highlights a risk that the organization must resolve before using it on sensitive content.
Official Sources: GDPR, Articles 28 and 44-49; European Commission adequacy decisions; EDPB recommendations on transfers; European Commission guide to the AI Act.
The Persistence of Secrets on Local Disk
A security audit should not be limited to real-time network traffic. AgentScoope investigations revealed a different phenomenon: in some cases, confidential information read by agents during the work session is stored in clear text in local log files within the user's configuration folders.
This means that sensitive data can remain at rest (data-at-rest) on the hard drive even after the software is closed, creating risks in terms of unencrypted backups, shared devices, or compliance requirements related to secure data deletion.
Practical Governance Lessons
The test results indicate that AI governance cannot rely solely on trust. Companies must establish strict policies on what data to include in projects where agents operate and define periodic session log cleaning procedures to minimize the local persistence of critical information.