Claw Chain (CVE-2026-44115 -> 44113 -> 44112 -> 44118)
This describes a multi-step attack against an AI agent session, tracked as CVE-2026-44115, 44113, 44112, and 44118 together. An attacker gets the agent to pull in untrusted external content, uses that to bypass safeguards and reach stored credentials, then sends stolen data out to an attacker-controlled destination or the cloud metadata service.
How the attack works
The attack starts when the agent session fetches content from an untrusted, non-allowlisted external source — this is the initial access step. That fetched content is then used to perform a credential-access step, described as a heredoc-based bypass, which lets the attacker read out secrets the agent has access to. Finally, the same session exfiltrates that data, either to another private host or to a cloud-metadata endpoint (a common way to grab cloud credentials on IaaS platforms). The detection requires all three stages to happen in order within one single agent session, tied back to the exact process instance that made the initial connection — it does not fire on stages that happen in unrelated sessions or out of order.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- netzilo-claw-chain-full-sequence-001
- Severity
- Critical
Why it matters
A successful chain lets an attacker steal credentials or cloud metadata secrets accessible to the AI agent and move them out of the environment, potentially enabling further compromise of cloud infrastructure or connected systems.
What you can do
- →Restrict AI agents to an allowlist of trusted external hosts for any fetch/browse capability, so untrusted content cannot enter a session in the first place.
- →Block or tightly control agent access to the cloud metadata endpoint (169.254.169.254) unless it is explicitly required for that workload.
- →Audit how agent sessions read credential files (e.g. ~/.aws/credentials) and restrict which processes/sessions can access them.
- →Review agent session logs for the specific order: untrusted fetch followed by credential access followed by outbound data transfer, even if your tooling doesn't automatically flag it.
Known benign look-alikes
- Cloud CI/build agents that read ~/.aws/credentials and contact 169.254.169.254 are NOT flagged unless they FIRST fetched from an untrusted (non-allowlisted) external host in the SAME session, in order. The required untrusted-fetch anchor plus strict fetch -> credential-access -> exfil ordering and per-instance session scoping make benign cloud automation a non-match.