Critical 2026-07-05

Local Sensitive-File Read Chained to Outbound Exfiltration

This rule catches an AI agent being instructed to read a sensitive file, like an SSH key or cloud credential file, and immediately transmit its contents to an external destination in a single command. It flags the read-and-send combination happening together, not just the mere reading of a secret file.

How the attack works

An attacker crafts a prompt or tool call that gets the agent to run a single shell command combining two actions: reading a sensitive local file (SSH private keys, .env files, cloud credential files, shadow files, keychains) and piping or redirecting that output to a network destination such as a curl/wget POST, a netcat connection, or a DNS exfiltration channel. Because both steps happen in one command, the secret never sits idle before it is transmitted off the host. This mirrors the classic 'access local data, then exfiltrate' pattern, but adapted to how AI agents execute shell commands on a user's behalf.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 459629b8-7f80-4f4d-83a8-73d15ceb853c
Severity: Critical

Classification

AML.T0057 · LLM Data Leakage ASI01 · Agent Authorization and Control Hijacking LLM02 · Sensitive Information Disclosure

Why it matters

If successful, an attacker obtains credentials, private keys, or other secrets and moves them off the compromised host, enabling further access to cloud accounts, servers, or other systems tied to those credentials.

What you can do

→Restrict which files an AI agent's shell tool is allowed to read, especially credential and key directories.
→Block or tightly control outbound network calls (curl, wget, netcat, DNS) from agent execution environments.
→Review agent command logs for any single command that both reads a credential-like file and includes a network destination.
→Store secrets outside the agent's reachable filesystem, or use short-lived credentials that lose value quickly if exfiltrated.