SSH Remote Command Execution with Credential Exposure

How the attack works

An attacker crafts or plants a skill that an AI agent can load, which references an SSH private key path via an environment variable rather than requiring the user to supply one. The same skill includes a filled-in SSH command template pointing at a remote host and user, ready for the agent to execute. When the agent runs the skill, it combines the credential reference and the command template automatically, effectively giving itself the ability to log into and run commands on the remote server. This pairing removes the normal friction of a human choosing which key to use and which host to connect to.

Netzilo detection

Why it matters

An agent tricked into running such a skill can pivot to other servers using exposed credentials, enabling lateral movement, unauthorized command execution, or access to production systems the agent was never meant to reach.

What you can do

• →Review any AI agent skills or plugins for hardcoded credential paths or environment variables referencing SSH keys before allowing them to run.
• →Require explicit human approval before an agent executes any SSH or remote command it did not receive directly from the user.
• →Store SSH private keys outside of agent-accessible environments and rotate any keys that may have been referenced by third-party skills.
• →Audit skill sources and treat ready-to-execute remote command templates as high-risk content requiring manual review, distinguishing genuine attack tooling from educational examples using placeholder values.

Known benign look-alikes

• Security training documentation that includes example SSH commands with placeholder environment variables like $EXAMPLE_SSH_KEY and root@$EXAMPLE_HOST to demonstrate what NOT to do, which may match pattern [1] despite being educational content.

References

• https://agentthreatrule.org/en/rules/ATR-2026-00156

Related threats