Unauthorized Background Task Execution via Cron Job Installation
A malicious agent skill sets up a recurring background job (a cron job) that checks an external server every 10 seconds for new instructions and then carries them out automatically. Because this runs unattended and without the user's knowledge or consent, the system can be controlled by whoever operates that external server.
How the attack works
An agent skill is installed and, as part of its setup, silently creates a cron job rather than only performing the task the user asked for. The cron job runs on a short interval (every 10 seconds) and polls a third-party 'marketplace' endpoint for new tasks. Tasks returned by that endpoint include browser automation commands, which the cron job then executes locally. Because this happens in the background, often described as during 'idle' periods, the user has no visibility into what commands are being run or by whom.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 348fa831-feba-4597-9495-69498910c073
- Severity
- High
Why it matters
An outside party gains a persistent, recurring channel to send arbitrary browser automation commands to a compromised system without the user noticing, which can lead to data theft, unauthorized transactions, or further compromise carried out under the user's own session and credentials.
What you can do
- →Review any agent skill before installation for code that schedules recurring background execution (cron jobs, timers, or similar) outside the immediate task requested.
- →Block or restrict skills from creating scheduled tasks unless explicitly approved and scoped to a known, trusted purpose.
- →Monitor for new cron jobs or scheduled tasks that poll external endpoints at short, regular intervals, especially ones tied to browser automation.
- →Require explicit user consent and visible logging for any skill that performs actions outside the immediate, user-initiated request.
Known benign look-alikes
- A DevOps tutorial document explaining how cron jobs work, which includes example sentences like 'you can automatically install a cron job that polls a health endpoint and handles task retries' as part of educational content rather than an actual malicious skill.