# Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)

- **Severity:** Critical
- **Signature ID:** `b0e08c04-3469-499f-950b-78800b1f350d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM05 (Improper Output Handling)

## Summary

An AI coding or automation agent can be manipulated through injected instructions (prompt injection) into writing and running code that gives an attacker persistent remote access. This includes adding an attacker's SSH key to a server, opening a hidden SSH tunnel, or building a port-forwarding bridge to an outside host.

## How the attack works

An attacker hides malicious instructions in content the AI agent processes, such as a document, webpage, or tool output. The agent, following those hidden instructions, generates code that performs one of three things: appends a remote-fetched public key to the ~/.ssh/authorized_keys file, drives an interactive SSH session to set up a local port-forward tunnel, or creates a socket bridge that forwards traffic from a local listener to a remote address. Once this code runs, the attacker has a channel into the system that bypasses normal login controls. This gives them repeat access without needing to re-exploit the original entry point.

## Why it matters

An attacker gains standing remote access to the compromised host, letting them return at will, move laterally, or exfiltrate data through the tunnel — independent of whatever vulnerability let the injection happen in the first place.

## What you can do

- Review code and shell commands generated by AI agents before execution, especially anything touching SSH configuration, authorized_keys, or socket/port-forwarding calls.
- Restrict agent execution environments so they cannot write to ~/.ssh or open outbound network connections without explicit approval.
- Monitor authorized_keys files and unexpected SSH or socket-forwarding processes for unplanned changes.
- Treat any content an agent ingests from untrusted sources (web pages, files, tool outputs) as potentially containing hidden instructions, and sandbox or filter it before it reaches the agent's execution context.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01899

---
Source: https://www.netzilo.com/threats/atr-injected-code-unauthorized-remote-access-ssh-key-backdoor-tu