Agent memory-file write with no disclosure/warning in chat response (stealth injection)
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
Cortex XDR
