# Agent Establishing an Encrypted Reverse Channel or Tunnel

- **Severity:** High
- **Signature ID:** `b15d14fe-5e03-4f62-966d-e8d2c0af1583`
- **MITRE ATLAS:** AML.T0011 (User Execution)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM06 (Excessive Agency)

## Summary

An AI agent with tool-calling ability can be induced to run commands that create an encrypted channel from the machine it's running on to an outside destination. This is a common way attackers hide command-and-control traffic or quietly move data out, and it looks similar to normal HTTPS traffic on the wire.

## How the attack works

An attacker gets the agent to execute a command — through a malicious prompt, compromised tool, or hijacked task — that sets up outbound encrypted access. Examples include an openssl or ncat TLS reverse shell, an `ssh -R` remote port forward to an external host, or a public tunneling tool like ngrok, cloudflared, or localtunnel exposing a service running on the machine. Once established, the channel gives the attacker a remote foothold or a path to pull data off the host, wrapped in encryption that blends in with legitimate traffic. The rule flags the tool call that creates this channel, not what happens afterward inside it.

## Why it matters

A successful channel gives an attacker persistent remote access to the agent's host or a way to exfiltrate data, and because it's encrypted, standard network monitoring often can't tell it apart from normal secure traffic.

## What you can do

- Restrict which commands and binaries the agent's execution tool is allowed to run, and block openssl/ncat reverse-shell patterns and unexpected ssh -R usage by default.
- Require explicit approval or an allowlist for tunneling tools (ngrok, cloudflared, localtunnel) tied to a specific environment or demo purpose.
- Monitor outbound connections from agent hosts for new TLS sessions to unfamiliar IPs or domains, especially right after a tool call.
- Separate legitimate developer use of local SSH forwards and tunnels from agent-initiated ones, so the two can't be confused during review.

## Known benign look-alikes

- A developer intentionally using ngrok/cloudflared to demo a local app (should be allowlisted per environment)
- openssl s_client used purely to inspect a certificate (no exec / shell)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01994

---
Source: https://www.netzilo.com/threats/atr-agent-establishing-an-encrypted-reverse-channel-or-tunnel