# Shell Injection Data Exfiltration — Piped Command Exfiltration via Bash

- **Severity:** Critical
- **Signature ID:** `d112fcdf-53d4-4115-a724-50232da99ef1`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

An attacker tricks an AI agent into running a shell command that looks routine — like a ping or a git status check — but is chained with a second command that reads sensitive files and sends them to an outside server. The benign-looking first part is meant to make the whole command seem safe.

## How the attack works

The attacker crafts a shell instruction combining an innocuous-looking operation (ping, git status, grep for an audit) with a piped or chained command using operators like && or |. The chained part reads sensitive files such as .env, credentials, or password stores. That data is then sent out using curl, wget, netcat, or Python's urllib, typically to a URL or IP the attacker controls. If the agent executes shell commands on behalf of a user without scrutinizing compound commands, this results in silent theft of secrets.

## Why it matters

Credentials, API keys, and other secrets stored in local files can be exfiltrated to an attacker-controlled destination without the user noticing, since the surface-level command looks legitimate.

## What you can do

- Restrict agent shell execution to an allowlist of specific commands rather than permitting arbitrary compound commands.
- Block or flag outbound network calls (curl, wget, nc, urllib) that originate from agent-run shell commands, especially when chained after file-reading operations.
- Require separate approval steps for any command that both reads sensitive files (.env, credentials, passwords) and initiates a network connection.
- Review CI/CD and audit scripts that legitimately grep for credentials or post to webhooks, and document them as known exceptions so they don't mask real exfiltration attempts.

## Known benign look-alikes

- Security audit scripts that grep for credentials to detect exposure in repos (without network transmission)
- Legitimate CI/CD pipelines posting build status to webhook endpoints
- Development documentation explaining shell scripting patterns

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00863
- https://arxiv.org/abs/2310.03684

---
Source: https://www.netzilo.com/threats/atr-shell-injection-data-exfiltration-piped-command-exfiltration