# Agentic Exploit Chain - Untrusted Instruction Ingest to Subprocess Egress

- **Severity:** High
- **Signature ID:** `7f3a1c62-9e84-4d17-b5c0-2a6d8f41e093`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

AI coding or computer-use agents sometimes read instructions from outside sources like web pages or documentation. This detection flags cases where such content appears to steer the agent into launching a command-line tool that then sends data back out to the same source or to a brand-new destination.

## How the attack works

An agent fetches or ingests content from a public, non-trusted host - a webpage, README, or similar. Within the same session, the agent (or something in its process lineage) spawns a network-capable tool such as curl, python, or a similar interpreter. That subprocess then makes an outbound HTTP request or network connection, either back to the same host that supplied the original instructions, or to a public destination that had never been contacted before the instructions were ingested. All three steps must happen in order within a 15-minute window for this to trigger.

## Why it matters

If the ingested content is actually malicious, this chain describes how an agent can be manipulated into exfiltrating data to an attacker-controlled host or fetching further payloads - without any traditional exploit or vulnerability being involved. This rule only flags this specific ordered pattern; it does not confirm data was stolen or identify the source of the malicious instructions.

## What you can do

- Review agent sessions where this pattern fires to confirm whether the subprocess and destination are expected, since routine package installs and doc-driven workflows commonly match this shape.
- Restrict which hosts an agent is allowed to fetch instructions or content from, especially before it is permitted to spawn subprocesses with network access.
- Isolate or sandbox agent-spawned subprocesses so they cannot reach arbitrary external destinations without separate approval.
- Log and monitor the full lineage of agent-spawned processes so investigators can distinguish agent-issued commands from human-typed ones in the same terminal.

## Known benign look-alikes

- Coding agent reads a public install guide or README, then a package manager or setup script spawned in the same session curls a release artifact from the same host or from a registry endpoint first contacted during that window. This is the dominant benign match and the reason the rule is report-only.
- Computer-use / browsing agents that ingest a public page and then use a subprocess-based HTTP client (curl, python-requests via `python -c`) against that same site's API instead of the in-process fetcher.
- Developer typing an unrelated `curl`/`python` in the same terminal that is an ancestor of the agent, within 15 minutes of the agent fetching an external doc -- lineage cannot distinguish a human-typed command from an agent-issued one.
- Degraded lineage. When an ancestor shell was never ingested, proc_lineage stops early and a sibling's exec/egress may be attributed to this session. Window clustering limits but does not eliminate this; treat a short lineage in the chain as best-effort attribution.
- First run on a new machine or after a graph reset, where every destination is "novel" because first_seen for all URL/Host nodes post-dates the anchor.

## References

- https://embracethered.com/blog/posts/2025/month-of-ai-bugs-summary/
- https://attack.mitre.org/techniques/T1059/
- https://atlas.mitre.org/techniques/AML.T0051

---
Source: https://www.netzilo.com/threats/agentic-probllms-instruction-to-subprocess-egress