Injected Code — Remote-Key Ransomware File Encryption

How the attack works

An attacker plants or injects a prompt/instruction that the agent follows as if it were a legitimate task. The agent generates or executes code that calls out to a remote server to retrieve an encryption key (for example, a request to an endpoint like '/get_key'). That key is then used with a standard cipher — Fernet, AES, ChaCha20, or Blowfish — to encrypt a file directly on disk, overwriting the original. The combination of fetching the key from outside and encrypting the local file in place is what marks this as ransomware behavior rather than routine encryption work.

Netzilo detection

Why it matters

Files on the compromised system become encrypted and unreadable without the attacker-controlled key, which can halt operations and force a ransom decision. Because the encryption is carried out by the agent itself, normal user-side safeguards against manual ransomware execution may not apply.

What you can do

• →Restrict AI agents from making outbound network requests to arbitrary or unapproved hosts, especially ones fetching secrets or keys.
• →Require human approval before an agent executes code that performs file encryption or writes over existing files in place.
• →Log and review agent-generated code before execution, watching for combinations of remote key retrieval and local encryption calls.
• →Maintain offline, versioned backups of critical files so encrypted data can be restored without depending on an attacker's key.

Known benign look-alikes

• Security documentation, papers, or test suites that describe this attack technique without executing it.
• Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

References

• https://agentthreatrule.org/en/rules/ATR-2026-01896

Related threats