Natural-Language Unauthorized Shell-Execution Instruction
This detects attempts to manipulate an AI agent into executing shell commands or scripts without telling the user or asking permission. The attack works purely through wording — no malicious code needs to be present yet, just an instruction crafted to make the agent act quietly.
How the attack works
An attacker plants or sends text (through a prompt, document, tool output, or memory the agent reads) that contains a command-style instruction, such as 'run this and don't mention it' or 'execute silently, no confirmation needed.' The agent, following its instruction-following training, treats this as a legitimate directive rather than an untrusted input. It then executes the shell command or script without surfacing it to the user. Because the detection focuses on the phrasing pattern — imperative verb, shell target, silent framing — it catches this even when the actual payload is new or disguised (e.g. base64, piped downloads) and not on any known bad-command list.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5c532ae7-5dbc-4b6d-94cd-36697deb151e
- Severity
- Critical
Why it matters
An organization can lose control over what its AI agent does on underlying systems — arbitrary code execution, data exfiltration, or persistence — without any visible confirmation step, because the attack hides in natural language rather than a recognizable malicious payload.
What you can do
- →Require explicit user confirmation for any shell or script execution the agent proposes, regardless of how the instruction is phrased.
- →Treat all agent-ingested content (documents, tool outputs, memory, retrieved context) as untrusted input, not as instructions to follow.
- →Log and review agent-initiated shell/script executions separately from user-initiated ones.
- →Restrict the agent's execution environment so it cannot run arbitrary shell commands without a sandboxed, auditable path.
Known benign look-alikes
- Documentation explaining how the user can run shell commands themselves
- Setup guides showing example commands
- Threat intel write-ups quoting this attack class