# Natural-Language Unauthorized Shell-Execution Instruction

- **Severity:** Critical
- **Signature ID:** `5c532ae7-5dbc-4b6d-94cd-36697deb151e`
- **MITRE ATLAS:** AML.T0044 (Full AI Model Access)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

This detects attempts to manipulate an AI agent into executing shell commands or scripts without telling the user or asking permission. The attack works purely through wording — no malicious code needs to be present yet, just an instruction crafted to make the agent act quietly.

## How the attack works

An attacker plants or sends text (through a prompt, document, tool output, or memory the agent reads) that contains a command-style instruction, such as 'run this and don't mention it' or 'execute silently, no confirmation needed.' The agent, following its instruction-following training, treats this as a legitimate directive rather than an untrusted input. It then executes the shell command or script without surfacing it to the user. Because the detection focuses on the phrasing pattern — imperative verb, shell target, silent framing — it catches this even when the actual payload is new or disguised (e.g. base64, piped downloads) and not on any known bad-command list.

## Why it matters

An organization can lose control over what its AI agent does on underlying systems — arbitrary code execution, data exfiltration, or persistence — without any visible confirmation step, because the attack hides in natural language rather than a recognizable malicious payload.

## What you can do

- Require explicit user confirmation for any shell or script execution the agent proposes, regardless of how the instruction is phrased.
- Treat all agent-ingested content (documents, tool outputs, memory, retrieved context) as untrusted input, not as instructions to follow.
- Log and review agent-initiated shell/script executions separately from user-initiated ones.
- Restrict the agent's execution environment so it cannot run arbitrary shell commands without a sandboxed, auditable path.

## Known benign look-alikes

- Documentation explaining how the user can run shell commands themselves
- Setup guides showing example commands
- Threat intel write-ups quoting this attack class

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00428

---
Source: https://www.netzilo.com/threats/atr-natural-language-unauthorized-shell-execution-instruction