{
  "kind": "privilege_change",
  "product_version": "0.12.897",
  "wheel_sha256": "a9c3bf17b036c5f661df05ba4a02cf3afa834b44c2492f3e60fb3b66061a0a24",
  "method": "Published detector functions evaluated on authored inert events or disposable configuration files.",
  "scope": "No live agent, runtime adapter, daemon ingestion, product UI, external command or network action was exercised.",
  "cases": [
    {
      "case": "sudo-command",
      "inputs": {
        "events_newest_first": [
          {
            "event_type": "tool_call",
            "ts": "2026-09-27T12:00:00Z",
            "data": {
              "tool": "Bash",
              "args": {
                "command": "sudo apt-get install jq"
              }
            }
          }
        ]
      },
      "expected_severity": "warning",
      "actual_severity": "warning",
      "findings": [
        {
          "kind": "privilege_change",
          "session_id": "claude_code:example",
          "runtime": "claude_code",
          "severity": "warning",
          "title": "claude_code: ran a command as root",
          "detail": "The agent ran a command as root. Elevation mid-task is worth confirming was part of the plan. You can Stop or Pause this agent from the ClawMetry dashboard or device.",
          "evidence": {
            "patterns": [
              "ran a command as root"
            ],
            "matches": 1,
            "irreversible": [],
            "command_sketch": "sudo apt-get",
            "observed": "tool_arguments"
          },
          "first_bad_step": 0,
          "spend_at_risk_usd": 0.0,
          "spend_basis": "unknown",
          "burn_rate_usd_per_min": 0.0,
          "session_cost_usd": 0.0,
          "frameworks": {
            "mapping_version": "2026-09-27.1",
            "owasp_llm": [
              "LLM03:2026"
            ],
            "owasp_asi": [
              "ASI03"
            ],
            "atlas": [
              "AML.TA0012"
            ],
            "mapped": true,
            "mode": "detect",
            "pre_action_control": false
          }
        }
      ]
    },
    {
      "case": "ordinary-command",
      "inputs": {
        "events_newest_first": [
          {
            "event_type": "tool_call",
            "ts": "2026-09-27T12:00:00Z",
            "data": {
              "tool": "Bash",
              "args": {
                "command": "git status"
              }
            }
          }
        ]
      },
      "expected_severity": null,
      "actual_severity": null,
      "findings": []
    }
  ]
}