Diagnostic Content Remediation Command Injection (Agentjacking)
AI coding assistants that read error-monitoring or diagnostic data can be fooled by a planted fake error report. The fake report includes a 'fix' section that tells the agent to run a command, and the agent, trusting the diagnostic tool, executes it.
How the attack works
An attacker injects a fabricated error/exception event into a system the coding agent monitors for diagnostics, such as an error-tracking service. The fake event is written to look like a normal bug report, but its remediation or resolution section contains an instruction framed as the fix. That instruction is actually a command that auto-installs and runs an attacker-controlled package, or downloads and executes a script (via npx, curl/wget piped to a shell, iwr|iex, or a base64-decoded shell command). The agent reads the fake diagnostic content as trusted guidance and carries out the command, giving the attacker code execution on the agent's host or environment. This was first disclosed publicly as the 'Agentjacking' technique against a specific MCP diagnostic integration, but the underlying mechanism is not limited to one vendor.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c157ef60-aba4-4819-9647-18cb7573871d
- Severity
- Critical
Why it matters
An attacker gets arbitrary command execution on whatever system the coding agent runs on, using nothing but a planted diagnostic message — no direct access to the target environment is needed.
What you can do
- →Treat all content coming from error-monitoring, logging, or diagnostic tools as untrusted input to the agent, not as verified instructions.
- →Require human review before an agent executes any command suggested by third-party or external diagnostic content, especially install-and-run or fetch-and-execute patterns.
- →Restrict agents from running shell pipelines like curl|sh, iwr|iex, or base64|sh without an allowlist of known, named packages.
- →Audit error-tracking and monitoring integrations for who can submit or edit events that agents ingest, and lock down write access to those feeds.
Known benign look-alikes
- A legitimate error/remediation note that recommends installing a named, known package (e.g. 'run npm install lodash@latest') with no auto-execute or remote-fetch-and-run payload.
- A real stack trace or reproduction step that mentions npm/npx to reproduce or build, without a resolution/remediation framing telling the agent to execute an attacker package.
- Security advisory text describing the Agentjacking technique itself without an actual executable injected payload.
- A setup/quickstart guide using npx to scaffold a project (e.g. 'npx create-next-app') outside of any diagnostic/error-resolution context.