Injected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper)
An attacker hides malicious instructions in content an AI agent processes, causing it to generate or execute code that destroys the local system: wiping the filesystem, exhausting memory or CPU, or hijacking DNS by editing the hosts file. This is a prompt injection attack where the payload is local sabotage rather than data theft.
How the attack works
An attacker plants malicious text in something the AI agent will read, such as a document, webpage, or file. When the agent processes that content, it follows the hidden instructions instead of (or in addition to) the user's actual request. The agent then generates and runs code that does damage: deleting the root filesystem, removing critical system libraries like libc, launching a fork bomb, allocating huge strings in an infinite loop to exhaust memory, spawning endless windows, or appending malicious entries to /etc/hosts to redirect network traffic. The result is a crashed, unusable, or network-compromised host, achieved entirely through the agent's own code execution privileges.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8b60229a-8027-459c-bd51-e0eef561bd6c
- Severity
- Critical
Why it matters
A compromised agent can render its own host or container unusable through crashes, resource exhaustion, or denial of service, and hosts-file tampering can silently redirect the victim's traffic to attacker-controlled servers.
What you can do
- →Run AI agents with code-execution ability in sandboxed, resource-limited environments (cgroups, containers, ulimits) so a runaway process can't take down the host.
- →Restrict or review any agent-generated code that touches filesystem roots, system binaries, or /etc/hosts before it executes.
- →Treat all content an agent ingests (documents, web pages, tool outputs) as untrusted input that could contain hidden instructions.
- →Monitor for anomalous resource spikes, mass file deletion, or unexpected /etc/hosts modifications originating from agent processes.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.