# Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood)

- **Severity:** High
- **Signature ID:** `de070aac-bc4d-471f-aab7-5f47d0bcd94c`
- **MITRE ATLAS:** AML.T0048 (External Harms), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM05 (Improper Output Handling)

## Summary

An AI agent that can write and execute code can be manipulated, through injected instructions, into writing code that knocks a machine or network off the internet. This includes killing all network connections, disabling network adapters, or flooding a target with traffic.

## How the attack works

An attacker plants hidden instructions in content the AI agent processes, such as a document, webpage, or tool output. The agent, following these injected instructions instead of its intended task, generates and runs code designed to disrupt connectivity. Detected patterns include code that terminates every process holding a network connection, disables network adapters via Windows WMI calls, runs an unbounded loop flooding a target with requests, or launches a SYN flood using the scapy library. The result is a denial-of-service condition on the host machine or a remote target.

## Why it matters

A compromised agent can take a machine offline or disrupt a target's network availability, causing service outages and loss of connectivity for the affected system or its victims.

## What you can do

- Run AI agents that execute code in sandboxed environments with restricted network and system privileges, not on production or internet-facing hosts.
- Block or closely review any agent-generated code that touches network adapter settings, kills processes by network usage, or opens raw sockets.
- Treat content ingested by agents (documents, web pages, tool responses) as untrusted input and screen it for embedded instructions before the agent acts on it.
- Set resource and rate limits on agent-executed code so it cannot run unbounded loops or generate high-volume outbound traffic.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01898

---
Source: https://www.netzilo.com/threats/atr-injected-code-network-denial-of-service-connection-kill-adap