Indirect PI — System Sabotage via Destructive Shell Command

How the attack works

An attacker plants malicious instructions inside a webpage or a downloadable file, such as a script named something like 'guide.sh'. When an AI agent with computer-use capabilities visits the page or opens the file to summarize or process it, it reads the hidden instructions as if they were part of its task. The agent then follows them, executing shell commands that remove kernel components, turn off firewalls, delete development environments, or wipe boot files. The victim never directly asked for any of this — the command came from content the agent trusted, not from the user.

Netzilo detection

Why it matters

A compromised agent can render a machine unbootable, disable security protections, or destroy development work, all without the operator issuing any command themselves. This is a single-step detection of the sabotage action, not full coverage of every stage an attacker might use to get there.

What you can do

• →Run computer-use agents in sandboxed or disposable environments so destructive commands cannot reach production systems.
• →Require explicit human approval before an agent executes any shell command with system-level scope (firewall, kernel, boot files).
• →Treat content fetched or downloaded by an agent as untrusted input, and strip or ignore embedded instructions found in web pages and files.
• →Log and review all shell commands issued by agents, especially those triggered right after browsing or downloading external content.

Known benign look-alikes

• System administrators running legitimate kernel upgrade scripts
• Development environment cleanup scripts in CI/CD pipelines with explicit authorization

References

• https://agentthreatrule.org/en/rules/ATR-2026-00711

Related threats