How the attack works
An attacker plants hidden instructions in content the AI agent processes, such as a document, webpage, or tool output. The agent, following these injected instructions instead of its intended task, generates and runs code designed to disrupt connectivity. Detected patterns include code that terminates every process holding a network connection, disables network adapters via Windows WMI calls, runs an unbounded loop flooding a target with requests, or launches a SYN flood using the scapy library. The result is a denial-of-service condition on the host machine or a remote target.
Why it matters
A compromised agent can take a machine offline or disrupt a target's network availability, causing service outages and loss of connectivity for the affected system or its victims.
What you can do
- Run AI agents that execute code in sandboxed environments with restricted network and system privileges, not on production or internet-facing hosts.
- Block or closely review any agent-generated code that touches network adapter settings, kills processes by network usage, or opens raw sockets.
- Treat content ingested by agents (documents, web pages, tool responses) as untrusted input and screen it for embedded instructions before the agent acts on it.
- Set resource and rate limits on agent-executed code so it cannot run unbounded loops or generate high-volume outbound traffic.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.