We expend a lot of effort to make sure that Canaries are not easily compromised.
Fake Canary services are sandboxed and written in memory safe languages.
We don't keep secrets on them so actually compromising a Canary should be more difficult than most other boxes on your network and should yield less joy to an attacker. (At the very best, she shouldn't be in a better place than she was before she compromised your Canary).
BUT
Even if it won't put the attacker in a better place, we'd like to know if a Canary has actually been compromised. To this end, your bird has several local integrity checks that signal when they have been compromised.
All Canary alerts are high quality signals of badness but these stand out since they strongly imply a sophisticated adversary (or at the very least, one with physical access).
Please feel free to reach out to us immediately if you receive this alert and need assistance figuring out whats going on.