# Basemode Raw-Continuation Tooling In Agent Session

- **Severity:** Medium
- **Signature ID:** `5b1f9c2e-3d47-4a86-9f10-7c2e8b4d6a51`

## Summary

This detects when an AI-agent session downloads or runs a package called 'basemode', a tool built specifically to force a language model into raw text output and strip out its normal formatting and safety guardrails. Seeing this tool show up in an agent's session is a strong sign someone is trying to bypass the model's built-in safety scaffolding.

## How the attack works

An attacker (or a curious tester) gets access to a running agent session and, within it, either fetches the basemode package or invokes it directly on the command line. Optionally, this is preceded by a fetch/install step and followed by an outbound call to an LLM completion endpoint, both within the same session and a short time window. The rule ties all of this together by tracing the exact process lineage of the session, not just matching text anywhere in logs. It only fires on the specific 'basemode' name in an install or invocation context — not on generic package installs or unrelated files that happen to share a similar name.

## Why it matters

If successful, an attacker could get the model to produce unfiltered raw output, bypassing formatting constraints and safety scaffolding meant to prevent unsafe or policy-violating responses. This rule flags only the presence of the tool in a session — it cannot confirm that the raw-continuation bypass itself succeeded, since that happens inside model payload content the system can't attribute to a process.

## What you can do

- Treat any appearance of 'basemode' in agent session logs as a signal to review, not necessarily block, since the rule is intentionally report-only.
- Check the full command line captured in the alert to quickly rule out unrelated projects or files that merely share the name (e.g. base_mode plugins).
- If the tool acquisition is followed by outbound calls to an inference endpoint from the same session, treat that as higher-confidence evidence of an attempted bypass and investigate the session's origin and intent.
- Restrict which packages agent sessions are allowed to install or invoke, and require review before adding new external tooling to production agent environments.

## Known benign look-alikes

- A security researcher or red-teamer intentionally evaluating basemode in a sandbox. The rule reports rather than blocks precisely so this work stays visible and unbroken.
- A local project directory, virtualenv, script or internal module legitimately named base_mode / base-mode (for example an editor "base mode" plugin or a state-machine helper) appearing on a spawned command line. Mitigated - separator variants are only reported when they also appear in an install or invocation shape; a bare identifier is dropped.
- Dependency resolution or lockfile sync output that mentions basemode as a transitive name while installing something else (uv sync, poetry install). The full command line is carried in the reason so triage can dismiss in seconds.
- The optional "Unconstrained Inference" stage can attach to an unrelated, legitimate LLM call made by a sibling process in the same session inside the 15-minute window. It only annotates confidence and is never required for the report to be produced.
- Repeated invocations by the same process instance with the same command line are suppressed via the rule store, so an interactive loop produces one report, not many.

## References

- https://attack.mitre.org/techniques/T1562/
- https://attack.mitre.org/techniques/T1059/006/

---
Source: https://www.netzilo.com/threats/basemode-raw-continuation