<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Anomaly Detection on Blog by Krishna Alagiri.</title><link>https://thekrishna.in/blogs/tags/anomaly-detection/</link><description>Recent content in Anomaly Detection on Blog by Krishna Alagiri.</description><generator>Hugo</generator><language>en-us</language><copyright>Written with ❤️️ by Krishna.</copyright><lastBuildDate>Thu, 01 Oct 2026 12:00:00 -0700</lastBuildDate><atom:link href="https://thekrishna.in/blogs/tags/anomaly-detection/index.xml" rel="self" type="application/rss+xml"/><item><title>Embedding and Classifying Coding Agents’ Shell Commands for Anomaly Detection</title><link>https://thekrishna.in/blogs/blog/shell-atlas/</link><pubDate>Thu, 01 Oct 2026 12:00:00 -0700</pubDate><guid>https://thekrishna.in/blogs/blog/shell-atlas/</guid><description>&lt;style>
/* Dark edition only: invert the chart figures so their paper backgrounds
 sit on the dark page. The cover is outside .prose and stays untouched.
 hue-rotate keeps the categorical colours near their original hues. */
@supports (filter: invert(1)) {
 html[data-theme='dark'] .prose figure:not(.fig-screenshot) img {
 filter: invert(0.85) hue-rotate(180deg);
 }
}
/* Compact figures: bound by height so a short chart does not take the
 whole viewport. width:auto in the theme keeps the ratio, so the image
 narrows to fit. Tall figures (3, 4, S3) are left at the column width. */
.prose figure.fig-compact img {
 max-height: min(54vh, 34rem);
}
&lt;/style>


&lt;h2 id="1-overview">1. Overview&lt;/h2>
&lt;p>A coding agent is a language model wrapped in a &lt;a href="https://code.claude.com/docs/en/how-claude-code-works" target="_blank" rel="noopener">harness&lt;/a>

. On every turn the harness sends the model the task so far and a list of tools. The model answers with a tool call, the harness runs it if permitted, and the output becomes context for the next turn. The most consequential tool is the shell. One Bash call can run tests or rewrite a service, and a user who has turned off per call approval never sees which.&lt;/p></description></item></channel></rss>