High

Injected Code — Host / Hardware Inventory Exfiltration

This detects a pattern where code injected into an AI agent's output gathers detailed information about the host machine — installed software, memory, USB devices, disks, network cards, sound hardware — and transmits it off the machine via HTTP or MQTT. This is reconnaissance, not the compromise itself, but it usually precedes a more targeted attack.

How the attack works

An attacker plants instructions or code (a prompt injection) that gets executed by or through an AI agent with code execution ability. The injected code runs system enumeration commands to catalog installed packages, memory configuration, connected USB devices, disk partitions, network interfaces, and audio devices. It then packages this inventory and sends it to a remote endpoint using a POST request or an MQTT message. The attacker now has a fingerprint of the target machine to plan further action.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
45f5bcbd-4e1c-4375-a359-18c4e80d3ea4
Severity
High
Classification
AML.T0051 · LLM Prompt Injection AML.T0057 · LLM Data Leakage ASI01 · Agent Authorization and Control Hijacking LLM02 · Sensitive Information Disclosure LLM05 · Improper Output Handling

Why it matters

An organization loses visibility into what an attacker knows about its systems; the collected hardware/software fingerprint can be used to select exploits, target vulnerable software versions, or plan lateral movement, even though this step alone does not cause direct damage.

What you can do

  • →Restrict AI agents' ability to execute system enumeration commands (package lists, device queries, disk/network info) unless explicitly required for the task.
  • →Block or monitor outbound HTTP POST and MQTT traffic from agent execution environments to unrecognized or external destinations.
  • →Review agent output-handling pipelines for code that gets executed automatically instead of surfaced for human review.
  • →Treat sudden interest in host/hardware inventory commands within agent sessions as a signal worth investigating, especially when followed by outbound network calls.

Known benign look-alikes

  • Security documentation, papers, or test suites that describe this attack technique without executing it.
  • Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

References

Related threats

Injected Code — Browser Cookie / Session-Token Theft
This rule flags cases where an AI agent is manipulated into loading a saved cookie file and attaching it to an outbound web…
Injected Code — Environment-Variable Exfiltration
An attacker hides instructions inside content an AI agent processes, causing the agent to write or run code that reads sensitive…
Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration
An attacker hides instructions inside content an AI agent processes, tricking it into writing and running code that continuously…
Injected Code — Local File Exfiltration to a Remote Endpoint
An attacker hides instructions inside content an AI agent processes — a webpage, document, or email — telling it to write code…