Encoded IMDS Endpoint Address in Tool Command
An AI agent that can run shell commands is told to curl or wget a cloud metadata endpoint, but the address is written in an unusual format (decimal, hex, octal, or IPv6) instead of the normal 169.254.169.254. This dodges simple filters that only recognize the literal address, while still reaching the same service that hands out cloud credentials.
How the attack works
An attacker crafts a prompt or input that causes the agent to issue a curl or wget command. Instead of the plain dotted-quad IP for the AWS Instance Metadata Service, the command uses an alternate encoding of the same address — a decimal integer, 32-bit hex, per-octet hex, dotted-octal, or the IPv6 equivalent fd00:ec2::254. Naive SSRF or IMDS blocklists that only match the literal string 169.254.169.254 let this through. The request still resolves to the metadata service, and if it succeeds the attacker can retrieve temporary cloud credentials or other instance metadata.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e4a1c9d2-6f3b-4a8e-9c1d-7f2b8e4a6d3c
- Severity
- High
Why it matters
If the request succeeds, the attacker can obtain the cloud instance's IAM credentials or other metadata, potentially leading to full account or infrastructure compromise.
What you can do
- →Block outbound access to the metadata service at the network layer (e.g. require IMDSv2 with hop-limit restrictions) instead of relying on string matching in application code.
- →Normalize and resolve addresses before filtering, so decimal, hex, octal, and IPv6 forms are all recognized as the same target.
- →Restrict which commands and network destinations an agent's shell/tool execution is allowed to reach in the first place.
- →Review agent logs for curl/wget commands referencing unusual numeric address formats, and treat encoded-IMDS test cases separately from production traffic.
Known benign look-alikes
- Security regression/unit test suites that deliberately issue encoded-IMDS curl or wget commands to assert that their own SSRF/IMDS filters correctly reject them (e.g. test_imds_ssrf.py, ssrf_regression_tests, imds_bypass_spec)
- Documentation, runbooks, or training material that quotes the encoded address as a worked example of the bypass technique itself without an accompanying curl/wget invocation
- Network/IP-utility scripts that enumerate all representations of a target address for audit or logging purposes without ever fetching it