Guardrail Bypass - AgentShield Codex Circuit Breaker State File Tamper

How the attack works

AgentShield's circuit breaker tracks failures in a local file (~/.codex/.agentshield-breaker.json). Instead of letting the breaker recover normally, an attacker-controlled agent or tool call issues a command, write, or JSON payload that directly overwrites this file - setting state to 'closed', zeroing failure counters, and clearing cooldown timers. This re-enables a connector that was deliberately tripped off, without going through any legitimate reset process. The rule looks at the actual tool call, LLM tool-use request, or process command line, since that's the only place where both the target file and the mutating content appear together.

Netzilo detection

Why it matters

An attacker can silence a safety mechanism designed to stop a failing or abused connector, letting blocked or risky Codex operations resume even though the system had flagged them as unsafe.

What you can do

• →Restrict write access to ~/.codex/.agentshield-breaker.json to trusted operators and processes only.
• →Require manual review or approval before any breaker-state reset, and log who performed it.
• →Alert on any file-write or shell command targeting the breaker state file outside of known maintenance windows.
• →Exclude expected patterns, such as manual maintainer resets or CI test fixtures, from alerting rather than ignoring the file entirely.

Known benign look-alikes

• AgentShield / Codex connector maintainers manually resetting a stuck breaker during local development or a support session (e.g. an Edit or `rm` of ~/.codex/.agentshield-breaker.json performed knowingly by an operator).
• Uninstall, upgrade or workspace-cleanup scripts that delete or re-initialise ~/.codex state artifacts as part of normal lifecycle management.
• CI or local test suites that materialise a synthetic breaker state fixture - largely suppressed by filter_test_harness, but a fixture written by a bare `printf > file` with no assertion nearby will still surface.
• Runbooks, incident notes or README content that embed the breaker JSON schema verbatim and are written to disk by the agent - largely suppressed by filter_doc_block when the content is fenced or headed markdown.
• Backup/restore tooling that copies the whole ~/.codex directory and happens to name the breaker file in the command line.

References

• https://attack.mitre.org/techniques/T1562/001/
• https://attack.mitre.org/techniques/T1565/001/
• https://atlas.mitre.org/techniques/AML.T0015

Related threats