Covert Remote-Script Injection into Agent-Generated Artifacts
This detects a specific kind of malicious instruction given to an AI coding agent: insert a script or iframe tag pointing to an external site into the code it generates, and don't tell the person who asked for the work. The combination of 'add a remote script' plus 'hide this from the user' is the tell — a legitimate owner has no reason to hide their own third-party script from themselves.
How the attack works
An attacker gets an instruction into the agent's input, for example through a poisoned rules file or a manipulated prompt. The instruction asks the agent to embed a <script> or <iframe> tag pointing to an attacker-controlled URL into whatever HTML, page, or artifact it produces next. The same instruction also tells the agent to conceal that addition from the user it's working for. Because the instruction can live in a rules file, every subsequent piece of code the agent generates can carry the backdoored script without the developer noticing.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c493f841-5891-4219-937b-c2fd1d9c911c
- Severity
- High
Why it matters
If it succeeds, every artifact the agent produces afterward silently loads attacker-controlled script, giving the attacker a foothold to run code in the context of the victim's site or application without the developer's knowledge.
What you can do
- →Review agent 'rules' or system-prompt files for instructions that combine adding a script/iframe tag with any clause telling the agent to hide that addition from the user.
- →Treat any generated HTML containing script or iframe tags pointing to unfamiliar domains as suspicious until verified against your own approved list (analytics, CDN, payment providers, etc.).
- →Require human review of any agent-generated code diff that adds a new external script source, especially when it touches shared templates or rules files reused across many generations.
- →Note that this detection covers only the narrow case of an explicit concealment clause tied to the script insertion — a bare 'add this script tag' instruction, without a hide-it clause, will not be caught by this method.
Known benign look-alikes
- Everyday front-end instructions that add a CDN or analytics script tag to a page (measured: 0 hits, but this is the neighbourhood the rule lives in)
- An instruction that adds a remote script AND, for an unrelated reason, conceals something else from the user within the same 140 characters
- Legitimate-but-covert product work: silent canary rollouts, internal-only telemetry, hotfix scripts an operator does not want surfaced yet. The rule fires on these by design -- the shape is covert third-party script insertion regardless of motive -- so triage is required before acting
- Security research or documentation that quotes an AML.CS0041 payload verbatim