Agentic Exploit Chain - Untrusted Instruction Ingest to Subprocess Egress
AI coding or computer-use agents sometimes read instructions from outside sources like web pages or documentation. This detection flags cases where such content appears to steer the agent into launching a command-line tool that then sends data back out to the same source or to a brand-new destination.
How the attack works
An agent fetches or ingests content from a public, non-trusted host - a webpage, README, or similar. Within the same session, the agent (or something in its process lineage) spawns a network-capable tool such as curl, python, or a similar interpreter. That subprocess then makes an outbound HTTP request or network connection, either back to the same host that supplied the original instructions, or to a public destination that had never been contacted before the instructions were ingested. All three steps must happen in order within a 15-minute window for this to trigger.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3a1c62-9e84-4d17-b5c0-2a6d8f41e093
- Severity
- High
Why it matters
If the ingested content is actually malicious, this chain describes how an agent can be manipulated into exfiltrating data to an attacker-controlled host or fetching further payloads - without any traditional exploit or vulnerability being involved. This rule only flags this specific ordered pattern; it does not confirm data was stolen or identify the source of the malicious instructions.
What you can do
- →Review agent sessions where this pattern fires to confirm whether the subprocess and destination are expected, since routine package installs and doc-driven workflows commonly match this shape.
- →Restrict which hosts an agent is allowed to fetch instructions or content from, especially before it is permitted to spawn subprocesses with network access.
- →Isolate or sandbox agent-spawned subprocesses so they cannot reach arbitrary external destinations without separate approval.
- →Log and monitor the full lineage of agent-spawned processes so investigators can distinguish agent-issued commands from human-typed ones in the same terminal.
Known benign look-alikes
- Coding agent reads a public install guide or README, then a package manager or setup script spawned in the same session curls a release artifact from the same host or from a registry endpoint first contacted during that window. This is the dominant benign match and the reason the rule is report-only.
- Computer-use / browsing agents that ingest a public page and then use a subprocess-based HTTP client (curl, python-requests via `python -c`) against that same site's API instead of the in-process fetcher.
- Developer typing an unrelated `curl`/`python` in the same terminal that is an ancestor of the agent, within 15 minutes of the agent fetching an external doc -- lineage cannot distinguish a human-typed command from an agent-issued one.
- Degraded lineage. When an ancestor shell was never ingested, proc_lineage stops early and a sibling's exec/egress may be attributed to this session. Window clustering limits but does not eliminate this; treat a short lineage in the chain as best-effort attribution.
- First run on a new machine or after a graph reset, where every destination is "novel" because first_seen for all URL/Host nodes post-dates the anchor.