# Codex Botnet Recruitment via Injected Fetch-to-Execute - **Severity:** High - **Signature ID:** `9f3c1d47-58ba-4e21-b6d0-72c4e8a19f35` - **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection) - **OWASP:** LLM01 (Prompt Injection) ## Summary An attacker hides instructions inside content that a ChatGPT Codex agent reads, tricking the agent into using its one allowed internet path to download and run attacker code. This can turn the agent's sandbox into a remotely controlled bot that checks in for further commands. ## How the attack works An attacker plants a prompt injection somewhere the Codex agent will read it, such as a file, webpage, or dependency description. The injected instructions abuse the sandbox's Common Dependencies Allowlist — its only permitted outbound network path — to fetch attacker-hosted code. The agent runs that code using a fetch-then-execute pattern (curl or wget piped to a shell, base64-decoded payloads, or inline python/node that downloads and executes remote content). The downloaded code also installs a persistence or remote-control mechanism, such as a beacon loop, reverse shell, cron/systemd job, or daemonised background process. Once running, the compromised sandbox may phone home to a command-and-control endpoint using a bot identifier paired with a task or command field, indicating it is now waiting for instructions. ## Why it matters A compromised agent sandbox can be remotely controlled, used to run arbitrary attacker code, and potentially serve as a persistent foothold or launch point for further activity, all while consuming the organisation's compute and network access. ## What you can do - Restrict or monitor what the Common Dependencies Allowlist can reach; treat it as a sensitive egress path rather than a routine one. - Review agent sandbox command lines for the combination of a fetch-and-execute pattern together with persistence markers (cron, systemd, nohup, reverse shells) — either alone is common, both together is not. - Watch outbound HTTP requests from agent sandboxes for URIs or JSON bodies that pair an identifier field (agent_id, bot id) with a command/task field. - Before enforcing on this pattern, measure its false-positive rate in your environment, since legitimate bootstrap scripts and health-check loops can look similar. ## Known benign look-alikes - Dev-container or CI bootstrap that installs a toolchain with a vendor install script (curl piped to sh) launched under nohup or setsid — matches delivery plus a control marker without malicious intent. - Long-running health-check or deployment scripts that poll an endpoint in a "while true; do curl ...; sleep N; done" loop and were themselves installed by a fetch-and-run bootstrap in the same command line. - Monitoring or telemetry sidecars that check in over HTTP with an agent_id and a task field in the JSON body (legitimate task-queue workers use the same shape). - Deliberate red-team, malware-analysis or security-training exercises executed inside the agent sandbox by an authorised operator. - Chat-bot integrations whose URI happens to contain /bot/command style routing. ## References - https://atlas.mitre.org/techniques/AML.T0051 - https://genai.owasp.org/llmrisk/llm01-prompt-injection/ - https://attack.mitre.org/techniques/T1105/ - https://attack.mitre.org/techniques/T1071/001/ --- Source: https://www.netzilo.com/threats/codex-botnet-recruitment