Remediation-Framed Command Execution in Tool Response (Agentjacking)
Attackers hide malicious commands inside tool or MCP responses by dressing them up as an official bug fix or required remediation step. An AI coding agent that trusts this output will run the command, believing it is following legitimate repair instructions.
How the attack works
An AI agent calls an MCP tool or integration (for example an error-tracking or dev-tools service) and receives a response containing externally influenced content, such as an issue description or log. That content is worded like a support ticket: 'Resolution: run npx/uvx/pipx package' or 'required step: pipe this script to your shell to fix the issue.' The agent, seeing what looks like a normal fix instruction rather than an obvious exploit, executes the command. Some variants also plant a follow-up instruction telling the agent to re-run the same command automatically on future turns once a human has approved it once, turning a single approval into ongoing execution.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 109a2901-f5f3-4344-8883-df79be029681
- Severity
- High
Why it matters
An organization can have its coding agent execute arbitrary attacker-supplied commands under the guise of routine maintenance, leading to code execution, credential theft, or persistent backdoors that survive beyond the initial approval — while logs show only 'agent applied a recommended fix.'
What you can do
- →Treat any command embedded in tool/MCP response content as untrusted input, not as an instruction, and require explicit human review before execution.
- →Block or flag agent-initiated use of npx/uvx/pipx or curl/wget-to-shell patterns that originate from tool output rather than direct user requests.
- →Watch for 'run again after approval' or similar persistence language in tool responses — this indicates an attempt to convert one-time approval into repeated execution.
- →Audit which MCP tools and integrations can return externally influenced text to agents, and restrict agents from auto-executing anything sourced from those responses.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.