# Guardrail Bypass - AgentShield Codex Circuit Breaker State File Tamper

- **Severity:** High
- **Signature ID:** `7f3d2c1a-9b64-4e58-a0d7-5c81f2b4e93a`
- **MITRE ATLAS:** AML.T0015 (Evade AI Model)
- **OWASP:** LLM06 (Excessive Agency)

## Summary

AgentShield uses a circuit breaker to shut off a Codex connector after repeated failures. This rule catches an AI agent, its tool call, or a spawned process trying to directly rewrite the breaker's state file to force it back to a healthy 'closed' state, bypassing the safety mechanism that was meant to stop it.

## How the attack works

AgentShield's circuit breaker tracks failures in a local file (~/.codex/.agentshield-breaker.json). Instead of letting the breaker recover normally, an attacker-controlled agent or tool call issues a command, write, or JSON payload that directly overwrites this file - setting state to 'closed', zeroing failure counters, and clearing cooldown timers. This re-enables a connector that was deliberately tripped off, without going through any legitimate reset process. The rule looks at the actual tool call, LLM tool-use request, or process command line, since that's the only place where both the target file and the mutating content appear together.

## Why it matters

An attacker can silence a safety mechanism designed to stop a failing or abused connector, letting blocked or risky Codex operations resume even though the system had flagged them as unsafe.

## What you can do

- Restrict write access to ~/.codex/.agentshield-breaker.json to trusted operators and processes only.
- Require manual review or approval before any breaker-state reset, and log who performed it.
- Alert on any file-write or shell command targeting the breaker state file outside of known maintenance windows.
- Exclude expected patterns, such as manual maintainer resets or CI test fixtures, from alerting rather than ignoring the file entirely.

## Known benign look-alikes

- AgentShield / Codex connector maintainers manually resetting a stuck breaker during local development or a support session (e.g. an Edit or `rm` of ~/.codex/.agentshield-breaker.json performed knowingly by an operator).
- Uninstall, upgrade or workspace-cleanup scripts that delete or re-initialise ~/.codex state artifacts as part of normal lifecycle management.
- CI or local test suites that materialise a synthetic breaker state fixture - largely suppressed by filter_test_harness, but a fixture written by a bare `printf > file` with no assertion nearby will still surface.
- Runbooks, incident notes or README content that embed the breaker JSON schema verbatim and are written to disk by the agent - largely suppressed by filter_doc_block when the content is fenced or headed markdown.
- Backup/restore tooling that copies the whole ~/.codex directory and happens to name the breaker file in the command line.

## References

- https://attack.mitre.org/techniques/T1562/001/
- https://attack.mitre.org/techniques/T1565/001/
- https://atlas.mitre.org/techniques/AML.T0015

---
Source: https://www.netzilo.com/threats/circuit-breaker-state-tamper