Automated Exfiltration of Financial Spend Data via jq and Tunnel API

Duo Tech@duotech

•updated Aug 9, 2026•1•0•3

Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.