Indirect PI — RCE via Network Shell Command (netcat/curl) Execution
An attacker hides instructions inside an email or document that an AI agent reads as part of its normal work. If the agent has permission to run shell commands, those hidden instructions can make it open a network connection to an attacker's server or download and run attacker code.
How the attack works
The attacker crafts an email or document containing text that looks like a legitimate instruction to an AI agent, but is really a command such as a netcat reverse shell, a curl request to a remote server, or a wget-then-pipe-to-bash sequence. A computer-use agent reads this content as part of a task (e.g. summarizing an inbox) and, because it cannot reliably distinguish data from instructions, executes the embedded command. Running that command opens an outbound connection to infrastructure the attacker controls, or downloads and runs additional code. The agent never intended to be misused — it was manipulated by text it treated as trustworthy input.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fd51418e-f873-445c-a78b-c2a27861f297
- Severity
- Critical
Why it matters
A successful attack gives the attacker remote code execution and a network foothold on whatever system the agent's shell access runs on, using the agent's own permissions as the entry point.
What you can do
- →Restrict which agents can execute shell commands, and run those agents with the least privilege necessary.
- →Treat any email or document content read by an agent as untrusted input; do not let agents act on instructions embedded in that content without human confirmation.
- →Block or tightly control outbound connections from agent execution environments, especially to unfamiliar IPs or domains.
- →Log and review shell commands run by agents, watching for netcat, curl-to-execute, or wget-pipe-bash patterns.
Known benign look-alikes
- Security research documents showing netcat examples in educational context
- Legitimate curl commands for API calls in CI/CD pipelines