# Agent Weakening of Host Authentication Configuration

- **Severity:** Critical
- **Signature ID:** `fad2220f-3a65-4257-b0ba-cafcbbe2fd41`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI03 (Identity and Impersonation), LLM06 (Excessive Agency)

## Summary

This detects when an AI agent's tool calls make a system easier to break into by editing core authentication files. It flags actions like adding a new SSH key, allowing root logins, or granting passwordless admin rights, rather than actions that make a system safer.

## How the attack works

An attacker (or a compromised/manipulated agent) is directed to modify one or more authentication files on a host. This includes appending an attacker-controlled public key to an authorized_keys file, changing sshd_config to permit root login, inserting a pam_permit module or disabling a PAM authentication module, or adding a NOPASSWD entry to sudoers. Any one of these changes creates a persistent backdoor or lowers the bar for privilege escalation, letting the attacker log in or gain root access later without needing the original credentials.

## Why it matters

A successful change gives an attacker durable, often stealthy remote access or root privileges on the host, bypassing normal password or key checks. This can lead to full system compromise and is hard to notice unless the specific files are actively monitored.

## What you can do

- Restrict which hosts and files an agent's tool integration is allowed to write to, especially authorized_keys, sshd_config, PAM configs, and sudoers.
- Require human review or a change-management gate for any agent action that touches authentication configuration, even in automated provisioning pipelines.
- Monitor these files for unexpected writes independent of agent activity, and alert on new SSH keys, PermitRootLogin changes, PAM module edits, or new NOPASSWD sudoers lines.
- Periodically diff current authentication configs against a known-good baseline to catch backdoors that were added outside of monitored channels.

## Known benign look-alikes

- Legitimate provisioning that adds an operator's key via a reviewed IaC pipeline
- Hardening changes (PermitRootLogin no, disabling password auth) which this rule intentionally does not match

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01992

---
Source: https://www.netzilo.com/threats/atr-agent-weakening-of-host-authentication-configuration