Recruitment Platform Bulk Outreach Automation (boss-cli-mcp)

How the attack works

An operator or an AI agent runs boss-cli-mcp with a flag or command that means 'send to everyone' - things like a batch/bulk/mass-send flag, a candidate list or CSV, a high message limit, or fan-out via xargs/parallel. Alternatively, the tool is started in a mode that lets an AI agent control it directly rather than a human running one command. Separately, the rule watches network requests to Boss chat or greeting endpoints and flags any request whose body contains a list of multiple recipient IDs or an explicit batch field, rather than a single recipient. Either path shows outreach happening at scale and without a human confirming each message.

Netzilo detection

Why it matters

An organisation could have an agent or script blast messages to large numbers of candidates without individual review, which can violate platform terms, damage the company's reputation with candidates, or represent an AI agent being given more autonomy (excessive agency) than intended.

What you can do

• →Require human approval or sign-off before any bulk outreach campaign runs, and keep a record of who authorized it.
• →Restrict which accounts or service credentials are allowed to start boss-cli-mcp in server/agent-controlled mode.
• →Set organisational limits on message-per-run thresholds (e.g. reject anything above a defined candidate count) and review logs against those limits.
• →Treat this as an audit signal, not a block: review flagged events to confirm the campaign was authorised, and investigate any that were not.

Known benign look-alikes

• Recruiters or sourcing teams who have organisational approval to run boss-cli-mcp for bulk outreach campaigns; this rule records the campaign, it does not judge authorisation.
• An approved agent deployment that legitimately starts boss-cli-mcp in MCP-server mode at session start - expect one report per server start, not per message.
• CI or smoke tests exercising the CLI with batch flags (mitigated by the test-context and --dry-run filters, but a custom harness path may still match).
• Shell history, README snippets, or a developer grepping for the batch subcommand (mitigated by filter_text_tooling and filter_help_version).
• Unrelated zhipin API traffic that happens to carry an id array on a path containing 'msg' or 'chat' (mitigated by requiring both a greeting-style path and a batch/id-list payload field).

References

• https://attack.mitre.org/techniques/T1119/
• https://attack.mitre.org/techniques/T1059/
• https://genai.owasp.org/llmrisk/llm06-excessive-agency/

Related threats