Agent Subprocess Credential Exfiltration Command Line
An AI coding/ops agent can be manipulated (via prompt injection) into running a single shell command that both reads sensitive credentials and sends them out to an attacker-controlled destination. This rule catches that exact pattern — read-then-send in one command line — plus related patterns where an agent downloads and immediately executes a remote payload.
How the attack works
An attacker injects instructions into content the agent processes, causing it to spawn a subprocess. That command line does two things at once: it reads credential material — cloud keys, SSH keys, .env files, keychain or browser secret stores, or secret environment variables — and it pushes that data out immediately, using curl/wget upload flags, a pipe to curl/nc/socat, scp/rsync to a remote host, or an inline HTTP POST. A related pattern covers the malware-staging step: fetching a remote script and piping it straight into an interpreter, or downloading a file and chmod +x'ing it in the same line, so a payload is fetched and made executable without a separate detectable step.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c1d92-4a6b-4c8e-9b21-5d0ea6f7c418
- Severity
- High
Why it matters
If successful, an attacker gets direct access to cloud, SSH, or application credentials, enabling account takeover, lateral movement, or further data theft — all triggered by manipulating the agent rather than compromising the underlying systems directly.
What you can do
- →Restrict what shell commands agent processes are allowed to run, and block outbound network calls initiated from agent-spawned subprocesses by default.
- →Store credentials outside locations agents can read directly (e.g., use short-lived tokens or a secrets broker instead of static keys in .env or config files).
- →Review agent-generated command lines for combined read+send or fetch+chmod patterns, especially where the destination is an unfamiliar host or raw IP.
- →Treat any content an agent ingests (web pages, tickets, files) as untrusted input capable of steering its actions, and sandbox agent execution accordingly.
Known benign look-alikes
- Secret-scanning or DevSecOps tooling (trufflehog, gitleaks, detect-secrets) that reads credential files and POSTs findings to a scanner API in the same command line.
- Credential backup or key-rotation scripts that scp/rsync an encrypted copy of ~/.ssh or ~/.aws to a managed host.
- CI or dev bootstrap one-liners that download a CLI binary into /tmp and chmod +x it in the same command (kubectl, terraform, gh) — matches the staging branch only.
- A developer or agent running curl -X POST against a local API from a working directory whose .env path is also named on the same command line.
- Tutorials, README snippets, or test fixtures replayed through a shell that embed example credentials — largely suppressed by filter_placeholder_secret.
- Authorised red-team or purple-team exfiltration exercises.