SSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection Flag
Some AI agent tools that wrap the SSH or SCP command line accept a 'host' argument and pass it straight through without checking it. If that argument starts with a dash instead of a real hostname, SSH reads it as a command-line option instead — including options that run arbitrary programs on the local machine before any connection is made.
How the attack works
An AI agent uses an MCP tool that calls the ssh or scp binary, passing along a host-identifier argument such as hostAlias, ssh_host, or target_host. Because the tool never rejects values starting with a dash, an attacker can make that argument look like '-oProxyCommand=...' or '-oPermitLocalCommand=...', which SSH interprets as an instruction to run a local command instead of a target to connect to. The attacker doesn't need direct access to the system — they only need to inject text into something the agent reads, like a web page, email, or file, that steers the LLM into calling the tool with a malicious argument. A related Windows-specific version chains a shell metacharacter (&, |, ^) into an scp path argument; because the server launches ssh.exe/scp.exe through a shell, that character lets a second command run.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7cdc8803-44f9-4013-a8ea-5d71fee465ea
- Severity
- High
Why it matters
Arbitrary command execution on the machine running the MCP server, achieved without any direct attacker access — just by getting attacker-controlled text into the agent's context. This can lead to full compromise of the host running the AI agent tool.
What you can do
- →Reject or strip any host-identifier argument that begins with a dash before passing it to ssh/scp, and insert an explicit '--' argument terminator.
- →Never invoke ssh.exe/scp.exe through a shell (avoid spawn with shell:true); use direct argument arrays instead.
- →Restrict which text sources the agent is allowed to treat as trusted input to tool arguments, especially for SSH/SCP wrapping tools.
- →Audit any MCP server that wraps ssh/scp for this argument-injection pattern, even if it is not the specific package named in the original report.
Known benign look-alikes
- A hostAlias/ssh_host value that is an ordinary hostname or an entry from ~/.ssh/config, with no leading dash (e.g. hostAlias: "prod-db-01")
- Documentation or a patch changelog discussing the -oProxyCommand option-injection class without an actual tool-call argument being set to it
- A localPath/remotePath value that happens to contain an ampersand in a filename (e.g. 'Q&A notes.txt') with no following executable token
- A bare '-w' with no digits following it (e.g. an implausible but conceivable literal alias name) -- ADVERSARIALLY CONFIRMED as a corner-case during review; the -w condition now requires real port-forward syntax (at least one digit, e.g. -w0:0 or -w2222)