«РТ-Информационная безопасность», named as part of Rostec, has released a shadow-AI detection solution on RT Protect EDR and formed two expertise packs for it. The packs record agent launch, host behavior, and data touched, and cover unauthorized clients, local models, and channels to external services. www1.ru dated the report 8 October 2026, 13:34, and credited the image to the Rostec press service. No customer, mandate, or deployment count is in the copy.
Who this affects
- For exporters: Not specified in the record.
- For investors: The copy is a product release. No price, contract, or revenue figure is stated.
- For counsel/compliance: The write-up states that use of AI tools is not itself an information-security violation, and that an AI agent acts in the user’s name, inherits that account’s permissions, and can reach repositories, access keys, and other data available to the account.
The read
The load-bearing line is the study result in the same copy: activity cannot be caught by network traffic or by the presence of an installed program alone, because local models can run on the machine with no call to external services, and the tools launch in different ways and are not always listed as corporate software.
The two packs map onto that split. «Контроль ИИ-агентов» logs launch and behavior on the host and the data accessed. «Теневой ИИ» covers unauthorized clients, local models, and outbound channels. The tools named as analyzed are Claude Code, OpenAI Codex, GitHub Copilot CLI, Gemini CLI, Cursor, Cline, OpenHands, and the local Ollama environment.
What was the action?
«РТ-ИБ» formed two expertise packages for the existing product RT Protect EDR after its specialists analyzed those tools and set detection signs from that work. RT Protect EDR is described as identifying both the presence of the software and its activity: command launch, file work, and other actions.
What’s the penalty / scope, and how is it set?
No penalty, order, or licence is in the record. The action is a product scope addition. «Контроль ИИ-агентов» records agent launch and behavior on the host and shows which data the agent accesses. «Теневой ИИ» covers unauthorized clients, local models, and channels used to reach external services. The stated aim is control of risks from AI access to corporate data.
Who else is exposed?
Not specified as a charged or designated party. The copy names the tools analyzed: Claude Code, OpenAI Codex, GitHub Copilot CLI, Gemini CLI, Cursor, Cline, OpenHands, and Ollama. It frames the user as companies whose staff run such agents on work computers without the information-security service knowing.
What happens next
No effective date, customer, signature release, or follow-on filing is in this copy. The open question is whether «РТ-ИБ» or Rostec publishes the detection signs or a deployment list. The Rostec site primary was not the document fetched for this record.