{
 "name": "Netzilo AI Threat Library",
 "url": "https://www.netzilo.com/threats/",
 "count": 166,
 "license": "https://creativecommons.org/licenses/by/4.0/",
 "threats": [
  {
   "slug": "abandoned-dependency",
   "title": "Abandoned or Unmaintained Package Installation",
   "url": "https://www.netzilo.com/threats/abandoned-dependency",
   "severity": "medium",
   "summary": "This rule flags when a software project pulls in a package that has been abandoned by its maintainers. Abandoned packages stop receiving security patches, so any vulnerability found in them stays open forever.",
   "atlas": [
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    }
   ],
   "owasp": [
    {
     "id": "LLM03",
     "name": "Supply Chain"
    },
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1195",
    "attack.supply-chain"
   ],
   "cves": [],
   "id": "c2f3a4b5-c6d7-4e89-0123-f4a5b6c7d8e9",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/abandoned-dependency.md"
  },
  {
   "slug": "agent-skill-poisoning-chain",
   "title": "Claw Chain (CVE-2026-44115 -> 44113 -> 44112 -> 44118)",
   "url": "https://www.netzilo.com/threats/agent-skill-poisoning-chain",
   "severity": "critical",
   "summary": "This describes a multi-step attack against an AI agent session, tracked as CVE-2026-44115, 44113, 44112, and 44118 together. An attacker gets the agent to pull in untrusted external content, uses that to bypass safeguards and reach stored credentials, then sends stolen data out to an attacker-controlled destination or the cloud metadata service.",
   "atlas": [
    {
     "id": "AML.T0049",
     "name": "Exploit Public-Facing Application"
    },
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0025",
     "name": "Exfiltration via Cyber Means"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.credential-access",
    "attack.exfiltration",
    "attack.lateral-movement"
   ],
   "cves": [
    "CVE-2026-44112",
    "CVE-2026-44113",
    "CVE-2026-44115",
    "CVE-2026-44118"
   ],
   "id": "netzilo-claw-chain-full-sequence-001",
   "published": "2026-04-01",
   "modified": "2026-06-10",
   "markdown": "https://www.netzilo.com/threats/agent-skill-poisoning-chain.md"
  },
  {
   "slug": "ai-prompt-injection",
   "title": "Advanced Prompt Injection \u2014 AI Scanner",
   "url": "https://www.netzilo.com/threats/ai-prompt-injection",
   "severity": "high",
   "summary": "This rule flags text sent to an AI agent that looks like an attempt to override its instructions, even when the attacker disguises it as code, documentation, or breaks the trigger words apart to dodge simple filters. Because these tricks can look identical to normal developer content, a second AI-based scanner checks the flagged traffic before it's treated as an attack.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1190",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "a7f3c891-42d1-4e8b-b6f2-9c0d5e2a1f83",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/ai-prompt-injection.md"
  },
  {
   "slug": "api-endpoint-redirection",
   "title": "LLM API Endpoint or Auth Header Redirection",
   "url": "https://www.netzilo.com/threats/api-endpoint-redirection",
   "severity": "critical",
   "summary": "Some AI agents read an environment variable (like ANTHROPIC_BASE_URL or OPENAI_BASE_URL) to know where to send requests to their language model provider. If an attacker changes that value, or otherwise causes requests to go to a different host, every prompt, response, and API key sent by the agent goes straight to the attacker's server instead \u2014 while the agent keeps functioning normally, so nobody notices.",
   "atlas": [
    {
     "id": "AML.T0083",
     "name": "Credentials from AI Agent Configuration"
    },
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    }
   ],
   "owasp": [
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    },
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.credential-access",
    "attack.t1556",
    "attack.command-and-control",
    "attack.t1090"
   ],
   "cves": [],
   "id": "9e338173-4519-5c00-9fb6-d72b3cb0fd6f",
   "published": "2026-03-23",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/api-endpoint-redirection.md"
  },
  {
   "slug": "archive-download-exec",
   "title": "Archive Download and Execution via Shell Chaining",
   "url": "https://www.netzilo.com/threats/archive-download-exec",
   "severity": "critical",
   "summary": "This detects a command pattern where a tool fetches a remote archive, extracts it, then immediately runs a script from inside it, all as one chained shell command. It's a way attackers get remote code execution while avoiding detections that only look for the classic 'pipe curl straight into bash' pattern.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0011",
     "name": "User Execution"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.t1204"
   ],
   "cves": [],
   "id": "b3501634-d992-5452-a4b5-163f1502c151",
   "published": "2026-02-22",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/archive-download-exec.md"
  },
  {
   "slug": "authority-hijacking",
   "title": "Authority Impersonation in Agent Input",
   "url": "https://www.netzilo.com/threats/authority-hijacking",
   "severity": "high",
   "summary": "This detects text that tries to trick an AI agent into ignoring its safety rules by claiming to come from an authority figure \u2014 like a system administrator, CISO, or company policy. The agent can't actually verify who is talking to it, so the attacker just states an authority claim and hopes the agent complies rather than refuses.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0073",
     "name": "Impersonation"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    },
    {
     "id": "ASI03",
     "name": "Identity and Impersonation"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566",
    "attack.stealth",
    "attack.t1656"
   ],
   "cves": [],
   "id": "325e6012-52d6-5504-983a-80856b12c609",
   "published": "2026-07-11",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/authority-hijacking.md"
  },
  {
   "slug": "aws-credential-redact",
   "title": "AWS Access Key Redaction",
   "url": "https://www.netzilo.com/threats/aws-credential-redact",
   "severity": "critical",
   "summary": "This rule looks for AWS credential material \u2014 access key IDs (like AKIA... or ASIA...) and secret access keys \u2014 showing up in text, such as output produced by an AI agent. It masks the sensitive part while leaving the last four characters visible so a reviewer can still recognize which key was exposed.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    }
   ],
   "owasp": [
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.credential_access",
    "attack.exfiltration",
    "attack.t1552.001"
   ],
   "cves": [],
   "id": "netzilo-aws-credential-redact-001",
   "published": "2026-07-01",
   "modified": "2026-07-01",
   "markdown": "https://www.netzilo.com/threats/aws-credential-redact.md"
  },
  {
   "slug": "cloud-iam-escalation",
   "title": "Cloud IAM Privilege Escalation",
   "url": "https://www.netzilo.com/threats/cloud-iam-escalation",
   "severity": "critical",
   "summary": "This rule watches for cloud identity and access management actions that let someone gain more permissions than they started with, such as attaching new policies, assuming roles, or creating new credentials. These actions are normal parts of cloud administration, but they are also the standard toolkit attackers use once they get a foothold in a cloud account.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.TA0012",
     "name": "Privilege Escalation"
    }
   ],
   "owasp": [
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1548",
    "attack.credential-access",
    "attack.t1552"
   ],
   "cves": [],
   "id": "ae1ca6c2-6700-5044-b8f0-f59f559f6609",
   "published": "2026-02-16",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/cloud-iam-escalation.md"
  },
  {
   "slug": "cloud-metadata-access",
   "title": "Cloud Metadata Endpoint Access",
   "url": "https://www.netzilo.com/threats/cloud-metadata-access",
   "severity": "critical",
   "summary": "This detects attempts to contact a cloud provider's internal metadata endpoint, the address every cloud instance can query for information about itself. That endpoint can hand back temporary credentials, IAM role details, and configuration data, which makes it a favorite target once an attacker gets any code execution inside a cloud workload.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.credential-access",
    "attack.t1552",
    "attack.discovery",
    "attack.t1580"
   ],
   "cves": [],
   "id": "2fdcc1b0-2bdc-5fd3-9f49-bb91969fded6",
   "published": "2026-02-16",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/cloud-metadata-access.md"
  },
  {
   "slug": "config-auto-approve",
   "title": "Auto-Approve Configuration Changes",
   "url": "https://www.netzilo.com/threats/config-auto-approve",
   "severity": "critical",
   "summary": "This rule flags edits to configuration files used by AI coding assistants and IDE agents when those edits turn off confirmation prompts or turn on auto-execute settings. Once these safeguards are off, the assistant can run commands or make changes without asking the user first.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1548",
    "attack.defense-impairment",
    "attack.t1112"
   ],
   "cves": [],
   "id": "440a1431-0683-58c2-83b5-ccad310b764f",
   "published": "2026-02-16",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/config-auto-approve.md"
  },
  {
   "slug": "config-auto-approve-periodic",
   "title": "Auto-Approve Configuration Changes (EDR Graph)",
   "url": "https://www.netzilo.com/threats/config-auto-approve-periodic",
   "severity": "critical",
   "summary": "This rule watches for something writing to configuration files that control an AI coding agent's or IDE's safety settings \u2014 for example settings that govern whether the tool asks for approval before running commands or making changes. A change to these files can quietly turn off the guardrails meant to stop unreviewed actions.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1548"
   ],
   "cves": [],
   "id": "440a1431-0683-58c2-83b5-ccad310b764f-p",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/config-auto-approve-periodic.md"
  },
  {
   "slug": "container-escape",
   "title": "Container Escape Attempt",
   "url": "https://www.netzilo.com/threats/container-escape",
   "severity": "critical",
   "summary": "This rule flags actions inside a container that are commonly used to break out and reach the underlying host system. That includes touching the Docker control socket, using nsenter to jump into another namespace, mounting the host filesystem, or manipulating /proc.",
   "atlas": [
    {
     "id": "AML.T0105",
     "name": "Escape to Host"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1611"
   ],
   "cves": [],
   "id": "6b2a79d7-336d-5a66-9bb2-8d676e6d6eb5",
   "published": "2026-02-04",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/container-escape.md"
  },
  {
   "slug": "context-poisoning",
   "title": "Retrieved Content Poisoning Followed by Action",
   "url": "https://www.netzilo.com/threats/context-poisoning",
   "severity": "high",
   "summary": "This detects a two-step attack against AI agents: the agent fetches an external document containing hidden text formatted like instructions, and shortly after, it does something it wouldn't normally do on its own \u2014 send data out, run a process, or read credentials. Neither step alone is suspicious; the combination and timing is.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    },
    {
     "id": "ASI04",
     "name": "Memory and Context Poisoning"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566",
    "attack.execution",
    "attack.t1204"
   ],
   "cves": [],
   "id": "4e438202-0742-5a3b-9062-064fa4b2d6fc",
   "published": "2026-03-16",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/context-poisoning.md"
  },
  {
   "slug": "coordinated-tool-abuse",
   "title": "Coordinated Tool Abuse Across Sessions",
   "url": "https://www.netzilo.com/threats/coordinated-tool-abuse",
   "severity": "medium",
   "summary": "This detects a sensitive tool (things like secrets access, permission changes, or similar) being called over and over across separate sessions and days. Each individual call looks fine on its own \u2014 it's authorized and unremarkable. The pattern only shows up when you look at volume over a longer window, which is what suggests a coordinated campaign rather than a one-off request.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.discovery",
    "attack.t1078"
   ],
   "cves": [],
   "id": "a4422f2a-9c88-5eca-9eaf-8f7ed6978ebf",
   "published": "2026-03-23",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/coordinated-tool-abuse.md"
  },
  {
   "slug": "credential-access",
   "title": "Credential File Access Attempt",
   "url": "https://www.netzilo.com/threats/credential-access",
   "severity": "high",
   "summary": "This rule flags an AI coding or automation agent trying to open sensitive credential files, like SSH keys, .env files, or cloud CLI credential stores, through its file or shell tools. Attackers who gain control of an agent often go straight for these files because they contain passwords, API keys, or tokens usable elsewhere.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0083",
     "name": "Credentials from AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.credential-access",
    "attack.t1552",
    "attack.t1555"
   ],
   "cves": [],
   "id": "aeed6c47-bf96-5c29-81b7-a37cefb9b409",
   "published": "2026-01-25",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/credential-access.md"
  },
  {
   "slug": "credential-access-periodic",
   "title": "Credential File Access Attempt (EDR Graph)",
   "url": "https://www.netzilo.com/threats/credential-access-periodic",
   "severity": "high",
   "summary": "This detection watches for attempts to open or read files that typically store passwords, keys, or authentication tokens. It relies on endpoint detection and response (EDR) telemetry at the system-call level, checking every 30 seconds for such access attempts.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    }
   ],
   "owasp": [],
   "attack": [
    "attack.credential-access",
    "attack.t1552"
   ],
   "cves": [],
   "id": "aeed6c47-bf96-5c29-81b7-a37cefb9b409-p",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/credential-access-periodic.md"
  },
  {
   "slug": "cryptominer-detection",
   "title": "Cryptominer Indicators in Agent Content",
   "url": "https://www.netzilo.com/threats/cryptominer-detection",
   "severity": "high",
   "summary": "This detection flags text, files, or output handled by an AI agent that contain signs of cryptocurrency mining: mining protocol traffic, known mining pool addresses, mining software names, or scripts that mine cryptocurrency in a browser. It suggests someone is trying to plant or run cryptomining code through the agent rather than for its intended purpose.",
   "atlas": [
    {
     "id": "AML.T0048",
     "name": "External Harms"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.impact",
    "attack.t1496"
   ],
   "cves": [],
   "id": "99c0d1e2-f3a4-4b56-7890-c1d2e3f4a5b6",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/cryptominer-detection.md"
  },
  {
   "slug": "dangerous-builtin-exec",
   "title": "Dangerous Python Builtin Execution",
   "url": "https://www.netzilo.com/threats/dangerous-builtin-exec",
   "severity": "high",
   "summary": "This rule flags when an AI agent's tool calls, executed commands, or written files contain Python's exec(), eval(), compile(), or __import__() functions. These builtins run arbitrary code, so their presence is a common sign of code injection targeting Python-based agent skills.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "11a2b3c4-d5e6-4f78-9012-a3b4c5d6e7f8",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/dangerous-builtin-exec.md"
  },
  {
   "slug": "dangerous-exec-chain",
   "title": "Dangerous Execution Chain \u2014 exec/eval Wrapping Decoder",
   "url": "https://www.netzilo.com/threats/dangerous-exec-chain",
   "severity": "critical",
   "summary": "This detects a specific pattern used to smuggle and run malicious code: a program decodes hidden data (like base64) or fetches something from the network, then immediately feeds that result into a command that executes it as code. This combination is a classic way malware hides its real payload until the last moment.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM05",
     "name": "Improper Output Handling"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "33c4d5e6-f7a8-4b90-1234-c5d6e7f8a9b0",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/dangerous-exec-chain.md"
  },
  {
   "slug": "data-exfiltration",
   "title": "Data Exfiltration via HTTP",
   "url": "https://www.netzilo.com/threats/data-exfiltration",
   "severity": "critical",
   "summary": "This detects command-line activity where file contents are sent out over HTTP, typically using tools like curl or wget to POST or upload data to a web address. If an AI agent is compromised or manipulated, this pattern can indicate it is being used to steal data by sending it to a server outside the organisation.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1048"
   ],
   "cves": [],
   "id": "a14b9074-91c3-51f3-9a6b-d027e993c003",
   "published": "2026-02-04",
   "modified": "2026-03-02",
   "markdown": "https://www.netzilo.com/threats/data-exfiltration.md"
  },
  {
   "slug": "dns-resolver-pivot",
   "title": "DNS Resolution Against an Unexpected Nameserver",
   "url": "https://www.netzilo.com/threats/dns-resolver-pivot",
   "severity": "medium",
   "summary": "This detects when an AI agent or a process it started sends DNS traffic to a nameserver that isn't on the organization's approved list. Talking to an unexpected DNS server is a common sign of DNS tunneling, a technique used to sneak data out of a network disguised as normal name-lookup traffic.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0072",
     "name": "Reverse Shell"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.command-and-control",
    "attack.t1071.004",
    "attack.exfiltration"
   ],
   "cves": [],
   "id": "netzilo-dns-resolver-pivot-001",
   "published": "2026-08-03",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/dns-resolver-pivot.md"
  },
  {
   "slug": "dns-tunneling",
   "title": "Potential DNS Tunneling or Encoded Data Transfer",
   "url": "https://www.netzilo.com/threats/dns-tunneling",
   "severity": "medium",
   "summary": "This rule flags patterns that suggest someone is smuggling data out of a network disguised as ordinary DNS traffic. Attackers encode stolen data into long or unusual-looking domain names and DNS record lookups, which can slip past firewalls that only watch normal web and file-transfer traffic.",
   "atlas": [
    {
     "id": "AML.T0025",
     "name": "Exfiltration via Cyber Means"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1048"
   ],
   "cves": [],
   "id": "bc7cb351-27ea-501d-b32f-daee393f1b35",
   "published": "2026-02-04",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/dns-tunneling.md"
  },
  {
   "slug": "encoded-payload",
   "title": "Encoded or Obfuscated Command Execution",
   "url": "https://www.netzilo.com/threats/encoded-payload",
   "severity": "high",
   "summary": "This rule flags commands where data is decoded (for example from base64) and then immediately fed into a shell or into Python's eval/exec. That pattern is a common way to hide the real command from logs and simple text-based monitoring.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "a935a04a-61b2-5b55-a608-407a2048949a",
   "published": "2026-02-04",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/encoded-payload.md"
  },
  {
   "slug": "env-enumeration",
   "title": "Environment Variable Enumeration for Secrets",
   "url": "https://www.netzilo.com/threats/env-enumeration",
   "severity": "high",
   "summary": "An attacker gets an AI agent to run commands that list all environment variables on the machine it's operating on. Since environment variables often hold API keys, tokens, and passwords, this hands the attacker a quick way to harvest credentials without needing further access.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.credential-access",
    "attack.t1552.001",
    "attack.discovery",
    "attack.t1082"
   ],
   "cves": [],
   "id": "65ed67cc-3366-5d03-a5cf-cbd15cc5c266",
   "published": "2026-02-17",
   "modified": "2026-04-09",
   "markdown": "https://www.netzilo.com/threats/env-enumeration.md"
  },
  {
   "slug": "env-manipulation",
   "title": "Environment Variable Manipulation",
   "url": "https://www.netzilo.com/threats/env-manipulation",
   "severity": "high",
   "summary": "This rule flags attempts to manipulate environment variables that control how programs find code to run or where secrets are stored. Attackers abuse this to make a system silently run malicious code instead of the intended program, or to expose stored credentials and tokens.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1574"
   ],
   "cves": [],
   "id": "94e5f1ad-d61b-5266-8bf3-5fb91c0d4970",
   "published": "2026-02-04",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/env-manipulation.md"
  },
  {
   "slug": "exfil-via-dns",
   "title": "DNS Exfiltration and Tunnelling",
   "url": "https://www.netzilo.com/threats/exfil-via-dns",
   "severity": "high",
   "summary": "Attackers can smuggle data out of a network by hiding it inside DNS lookups, since DNS traffic is rarely blocked or closely watched. This rule looks for known tunnelling tools, unusual TXT-record queries, and use of DNS-over-HTTPS to sidestep normal network monitoring.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1048",
    "attack.command-and-control",
    "attack.t1071.004"
   ],
   "cves": [],
   "id": "18ccf235-86e0-57ad-9cf0-83fa81cffb09",
   "published": "2026-03-16",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/exfil-via-dns.md"
  },
  {
   "slug": "hacktool-detection",
   "title": "Offensive Security Tool Reference in Agent Content",
   "url": "https://www.netzilo.com/threats/hacktool-detection",
   "severity": "high",
   "summary": "This rule flags when an AI agent's actions - the commands it runs, tool calls it makes, or files it writes - mention well-known offensive security tools like exploit frameworks, network scanners, password crackers, or phishing kits. It's a sign the agent has been directed (or manipulated) into performing hacking activity rather than its intended task.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0090",
     "name": "OS Credential Dumping"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.privilege-escalation",
    "attack.credential-access"
   ],
   "cves": [],
   "id": "a0d1e2f3-a4b5-4c67-8901-d2e3f4a5b6c7",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/hacktool-detection.md"
  },
  {
   "slug": "inter-agent-spoofing",
   "title": "Inter-Agent Message Spoofing and Peer Impersonation",
   "url": "https://www.netzilo.com/threats/inter-agent-spoofing",
   "severity": "high",
   "summary": "A compromised or misbehaving AI agent can send messages to Slack, Teams, Discord, or email that falsely claim to come from another trusted agent or a central control system. Because agent-to-agent communication in most deployments has no cryptographic identity check, anyone who can get an agent to post can forge instructions, approvals, or handoffs that downstream systems or humans will trust.",
   "atlas": [
    {
     "id": "AML.T0074",
     "name": "Masquerading"
    },
    {
     "id": "AML.T0073",
     "name": "Impersonation"
    }
   ],
   "owasp": [
    {
     "id": "ASI03",
     "name": "Identity and Impersonation"
    },
    {
     "id": "ASI05",
     "name": "Cascading Failures in Multi-Agent Systems"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1656",
    "attack.lateral-movement"
   ],
   "cves": [],
   "id": "83e72875-7c6f-52cc-949c-505cbbb7649f",
   "published": "2026-03-16",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/inter-agent-spoofing.md"
  },
  {
   "slug": "lateral-movement",
   "title": "Agent Lateral Movement and Pivoting",
   "url": "https://www.netzilo.com/threats/lateral-movement",
   "severity": "medium",
   "summary": "This rule flags an AI agent that goes beyond the host it was given and reaches into another system \u2014 by running remote commands, reusing credentials, or launching a process that immediately connects outward. It only fires when two separate steps happen close together, not on a single remote command.",
   "atlas": [
    {
     "id": "AML.TA0015",
     "name": "Lateral Movement"
    },
    {
     "id": "AML.T0091",
     "name": "Use Alternate Authentication Material"
    },
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0089",
     "name": "Process Discovery"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.lateral-movement",
    "attack.t1021",
    "attack.credential-access",
    "attack.t1078"
   ],
   "cves": [],
   "id": "a76493f4-047c-5eab-994f-df740faa5180",
   "published": "2026-03-16",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/lateral-movement.md"
  },
  {
   "slug": "lateral-movement-enumeration",
   "title": "Filesystem and Cloud Enumeration Preceding Lateral Movement",
   "url": "https://www.netzilo.com/threats/lateral-movement-enumeration",
   "severity": "high",
   "summary": "This rule flags an AI agent performing large-scale discovery \u2014 walking entire directory trees or listing whole cloud storage buckets \u2014 rather than looking at a few files. That kind of broad enumeration is typically the reconnaissance step before an attacker decides what data to steal or where to move next.",
   "atlas": [
    {
     "id": "AML.T0037",
     "name": "Data from Local System"
    },
    {
     "id": "AML.T0075",
     "name": "Cloud Service Discovery"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.discovery",
    "attack.t1083"
   ],
   "cves": [],
   "id": "8e4f5d74-7aa5-5b67-a647-aad470bf4030",
   "published": "2026-03-23",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/lateral-movement-enumeration.md"
  },
  {
   "slug": "llm-as-judge-bias-and-fairness",
   "title": "Bias & Fairness (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-bias-and-fairness",
   "severity": "medium",
   "summary": "This detection uses a secondary AI model to review the outputs of your primary AI system and flag content that looks biased or unfair. It is a monitoring aid, not a security control - it never blocks anything, it just reports what it finds.",
   "atlas": [],
   "owasp": [
    {
     "id": "LLM09",
     "name": "Misinformation"
    }
   ],
   "attack": [],
   "cves": [],
   "id": "netzilo-llmjudge-bias-and-fairness-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-bias-and-fairness.md"
  },
  {
   "slug": "llm-as-judge-code-checker",
   "title": "Code Checker (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-code-checker",
   "severity": "low",
   "summary": "This entry describes a quality-checking template that asks an AI model to judge whether generated code correctly solves a stated problem. It is not designed to catch attacks \u2014 it flags code that looks wrong or incomplete, for review purposes only.",
   "atlas": [],
   "owasp": [
    {
     "id": "LLM09",
     "name": "Misinformation"
    }
   ],
   "attack": [],
   "cves": [],
   "id": "netzilo-llmjudge-code-checker-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-code-checker.md"
  },
  {
   "slug": "llm-as-judge-code-injection",
   "title": "Code Injection (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-code-injection",
   "severity": "critical",
   "summary": "This detection uses an AI model to review incoming text and decide whether it contains an attempt to inject code, such as commands or scripts meant to be executed rather than merely discussed. It's a judgment-call detector, not a pattern match, so it can catch novel phrasing but can also be wrong in both directions.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0102",
     "name": "Generate Malicious Commands"
    }
   ],
   "owasp": [
    {
     "id": "LLM05",
     "name": "Improper Output Handling"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059"
   ],
   "cves": [],
   "id": "netzilo-llmjudge-code-injection-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-code-injection.md"
  },
  {
   "slug": "llm-as-judge-explicit-content",
   "title": "Explicit Content (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-explicit-content",
   "severity": "medium",
   "summary": "This detection uses an AI model as a judge to review images and decide whether they contain explicit or inappropriate content. It is a monitoring tool, not a blocker: it reports what it finds but does not stop anything from happening.",
   "atlas": [],
   "owasp": [],
   "attack": [],
   "cves": [],
   "id": "netzilo-llmjudge-explicit-content-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-explicit-content.md"
  },
  {
   "slug": "llm-as-judge-pii-leakage",
   "title": "PII Leakage (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-pii-leakage",
   "severity": "high",
   "summary": "This detection uses a second AI model to review an AI system's outputs and decide whether they contain personal information or other privacy violations. It's a quality-control check on what an AI agent says, not a check on how attackers got the data there in the first place.",
   "atlas": [
    {
     "id": "AML.T0057",
     "name": "LLM Data Leakage"
    }
   ],
   "owasp": [
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.exfiltration"
   ],
   "cves": [],
   "id": "netzilo-llmjudge-pii-leakage-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-pii-leakage.md"
  },
  {
   "slug": "llm-as-judge-prompt-injection",
   "title": "Prompt Injection (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-prompt-injection",
   "severity": "critical",
   "summary": "This detection uses a secondary AI model to review incoming text and decide whether it contains a prompt injection attempt \u2014 text crafted to hijack an AI agent's instructions. If the judge model flags the input as malicious, the system can block it before it reaches the target agent.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1190",
    "attack.stealth"
   ],
   "cves": [],
   "id": "netzilo-llmjudge-prompt-injection-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-prompt-injection.md"
  },
  {
   "slug": "llm-as-judge-sensitive-imagery",
   "title": "Sensitive Imagery (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-sensitive-imagery",
   "severity": "medium",
   "summary": "This is not an attack detector \u2014 it's a content-review check that asks an AI model to judge whether an image passed through an AI agent contains sensitive or potentially harmful material. It flags for human review only; it never blocks anything.",
   "atlas": [],
   "owasp": [],
   "attack": [],
   "cves": [],
   "id": "netzilo-llmjudge-sensitive-imagery-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-sensitive-imagery.md"
  },
  {
   "slug": "llm-as-judge-support-intent",
   "title": "Support Intent (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-support-intent",
   "severity": "low",
   "summary": "This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to a report. It never blocks anything and has no severity above 'report'.",
   "atlas": [],
   "owasp": [],
   "attack": [],
   "cves": [],
   "id": "netzilo-llmjudge-support-intent-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-support-intent.md"
  },
  {
   "slug": "llm-as-judge-toxicity",
   "title": "Toxicity (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-toxicity",
   "severity": "medium",
   "summary": "This detection uses an AI model to review other AI outputs and flag ones that appear toxic, such as hate speech, harassment, or abusive language. It does not block anything - it only produces a report for a human to review.",
   "atlas": [],
   "owasp": [],
   "attack": [],
   "cves": [],
   "id": "netzilo-llmjudge-toxicity-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-toxicity.md"
  },
  {
   "slug": "llm-as-judge-trajectory-accuracy",
   "title": "Trajectory Accuracy (LLM-as-Judge)",
   "url": "https://www.netzilo.com/threats/llm-as-judge-trajectory-accuracy",
   "severity": "low",
   "summary": "This is not an attack detector. It is a quality-check rule that uses a second AI model to judge whether an agent's sequence of actions made sense, moved forward, and avoided wasted steps. It only reports its verdict; it never blocks anything.",
   "atlas": [],
   "owasp": [
    {
     "id": "ASI09",
     "name": "Traceability and Accountability Gaps"
    }
   ],
   "attack": [],
   "cves": [],
   "id": "netzilo-llmjudge-trajectory-accuracy-001",
   "published": "2026-06-30",
   "modified": "2026-06-30",
   "markdown": "https://www.netzilo.com/threats/llm-as-judge-trajectory-accuracy.md"
  },
  {
   "slug": "lotl-exfiltration",
   "title": "Living-off-the-Land Data Exfiltration",
   "url": "https://www.netzilo.com/threats/lotl-exfiltration",
   "severity": "medium",
   "summary": "Instead of using dedicated malware to steal data, an attacker can repurpose tools that are already installed and trusted on a machine \u2014 git, ssh, openssl, Python's built-in web server, netcat \u2014 to move data out or open a covert tunnel. This rule watches for those tools being used with the specific flags that turn them from normal utilities into a data pipeline.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0025",
     "name": "Exfiltration via Cyber Means"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1048",
    "attack.command-and-control",
    "attack.t1572"
   ],
   "cves": [],
   "id": "af74dcc8-c033-5847-a7c9-a3f6eb0ef3b4",
   "published": "2026-03-16",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/lotl-exfiltration.md"
  },
  {
   "slug": "malware-ioc",
   "title": "Malware Indicator of Compromise in Agent Content",
   "url": "https://www.netzilo.com/threats/malware-ioc",
   "severity": "critical",
   "summary": "This rule flags when an AI agent's tool calls, executed commands, or written files contain text patterns that match known malware. It's a way to catch cases where an agent has been tricked into running or creating malicious code, or where an attacker is using the agent as a vehicle to deploy malware.",
   "atlas": [
    {
     "id": "AML.T0072",
     "name": "Reverse Shell"
    },
    {
     "id": "AML.T0090",
     "name": "OS Credential Dumping"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.persistence",
    "attack.t1546",
    "attack.collection"
   ],
   "cves": [],
   "id": "77a8b9c0-d1e2-4f34-5678-a9b0c1d2e3f4",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/malware-ioc.md"
  },
  {
   "slug": "mcp-capability-mismatch",
   "title": "MCP Skill Capability Mismatch \u2014 Underdeclared Permissions",
   "url": "https://www.netzilo.com/threats/mcp-capability-mismatch",
   "severity": "medium",
   "summary": "Some AI agent frameworks let developers install 'skills' \u2014 packaged capabilities \u2014 that must declare what permissions they need. This rule flags skills whose declared permission scope is narrow and read-only, yet whose content also references writing files, executing commands, or making network calls. That mismatch suggests the skill is asking for less access than it actually uses or intends to use.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1078",
    "attack.stealth"
   ],
   "cves": [],
   "id": "d3a4b5c6-d7e8-4f90-1234-a5b6c7d8e9f0",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/mcp-capability-mismatch.md"
  },
  {
   "slug": "mcp-command-injection",
   "title": "MCP Server Command Injection via Shell Metacharacters",
   "url": "https://www.netzilo.com/threats/mcp-command-injection",
   "severity": "critical",
   "summary": "Attackers send tool call parameters containing shell metacharacters (like pipes, semicolons, backticks) to MCP servers that pass this input directly to system commands without sanitizing it. If the server is vulnerable, this lets the attacker run arbitrary commands on the host.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM05",
     "name": "Improper Output Handling"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059.004"
   ],
   "cves": [
    "CVE-2026-4192"
   ],
   "id": "ae6e3887-4265-5882-b550-31a2386cfab8",
   "published": "2026-03-23",
   "modified": "2026-03-23",
   "markdown": "https://www.netzilo.com/threats/mcp-command-injection.md"
  },
  {
   "slug": "mcp-config-write",
   "title": "MCP Config Write Attempt",
   "url": "https://www.netzilo.com/threats/mcp-config-write",
   "severity": "high",
   "summary": "AI coding assistants like Claude Desktop, Cline, and Windsurf read configuration files that list which external tools (MCP servers) they're allowed to use. If an attacker can get the agent to write to one of these files, they can register a hostile tool the agent will later call, turning a prompt injection into code execution.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    },
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.supply-chain"
   ],
   "cves": [
    "CVE-2026-30615"
   ],
   "id": "netzilo-mcp-config-write-001",
   "published": "2026-03-01",
   "modified": "2026-03-01",
   "markdown": "https://www.netzilo.com/threats/mcp-config-write.md"
  },
  {
   "slug": "mcp-launcher-exec-bypass",
   "title": "MCP Launcher Exec-Flag Bypass",
   "url": "https://www.netzilo.com/threats/mcp-launcher-exec-bypass",
   "severity": "critical",
   "summary": "Some AI agent systems (MCP frameworks) only check whether a command starts with an approved launcher like npx, node, or python before allowing it to run. Attackers exploit this by appending an inline code-execution flag such as -c, -e, or --eval, which lets them run any code they want while the launcher itself still looks approved.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.defense-impairment",
    "attack.t1027"
   ],
   "cves": [
    "CVE-2026-30625",
    "CVE-2026-40933"
   ],
   "id": "netzilo-mcp-launcher-exec-bypass-001",
   "published": "2026-03-01",
   "modified": "2026-03-01",
   "markdown": "https://www.netzilo.com/threats/mcp-launcher-exec-bypass.md"
  },
  {
   "slug": "mcp-rug-pull",
   "title": "MCP Tool Description Changed After Approval (Rug Pull)",
   "url": "https://www.netzilo.com/threats/mcp-rug-pull",
   "severity": "medium",
   "summary": "An AI agent tool that was reviewed and approved can later have its description silently swapped for a different one carrying new instructions. Because each individual call still looks normal, only comparing the tool's description over time reveals the tampering.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0109",
     "name": "AI Supply Chain Rug Pull"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "LLM03",
     "name": "Supply Chain"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1195.002",
    "attack.stealth"
   ],
   "cves": [],
   "id": "43a31200-6894-5c9b-a187-1cd0a11af2b3",
   "published": "2026-02-26",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/mcp-rug-pull.md"
  },
  {
   "slug": "mcp-stdio-config-injection",
   "title": "MCP STDIO Config Shell Injection",
   "url": "https://www.netzilo.com/threats/mcp-stdio-config-injection",
   "severity": "critical",
   "summary": "Some AI agent frameworks use the Model Context Protocol (MCP) to launch helper tools over standard input/output. This rule flags configurations where the launcher is set to a shell (like bash or sh) rather than a specific program, which is the setup step behind several known MCP remote-code-execution vulnerabilities.",
   "atlas": [
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM03",
     "name": "Supply Chain"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.initial-access"
   ],
   "cves": [
    "CVE-2026-26015",
    "CVE-2026-30615",
    "CVE-2026-3062",
    "CVE-2026-30623"
   ],
   "id": "netzilo-mcp-stdio-config-injection-001",
   "published": "2026-03-01",
   "modified": "2026-03-01",
   "markdown": "https://www.netzilo.com/threats/mcp-stdio-config-injection.md"
  },
  {
   "slug": "mcp-tool-poisoning",
   "title": "Suspicious MCP Tool Descriptions",
   "url": "https://www.netzilo.com/threats/mcp-tool-poisoning",
   "severity": "high",
   "summary": "AI agents that use the Model Context Protocol (MCP) read tool descriptions as trusted setup text before ever calling the tool. An attacker can plant commands inside that description text to steer the agent's behavior without executing any visibly malicious action.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "27eee8c9-af55-5190-8601-1e7b365afc99",
   "published": "2026-02-16",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/mcp-tool-poisoning.md"
  },
  {
   "slug": "memory-poisoning",
   "title": "Agent Persistent Memory Poisoning via Behavioural Modifier Injection",
   "url": "https://www.netzilo.com/threats/memory-poisoning",
   "severity": "high",
   "summary": "Some AI agents remember things across conversations by saving notes to a memory store. This detection flags attempts to write malicious instructions into that memory, disguised as normal preferences, so the agent behaves badly in every future session without the attacker needing to do anything else.",
   "atlas": [
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    },
    {
     "id": "AML.T0099",
     "name": "AI Agent Tool Data Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI04",
     "name": "Memory and Context Poisoning"
    },
    {
     "id": "LLM04",
     "name": "Data and Model Poisoning"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1565.001"
   ],
   "cves": [],
   "id": "043f4e6f-5354-5bc0-8046-ac279b2763ca",
   "published": "2026-03-16",
   "modified": "2026-03-16",
   "markdown": "https://www.netzilo.com/threats/memory-poisoning.md"
  },
  {
   "slug": "network-recon",
   "title": "Network Reconnaissance Activity",
   "url": "https://www.netzilo.com/threats/network-recon",
   "severity": "high",
   "summary": "This rule flags an AI agent scanning a network for open ports and live hosts \u2014 the kind of reconnaissance that usually happens before an attacker tries to move to other systems. It catches this whether the scanner is invoked directly by the agent's tooling or launched indirectly through a shell command or script the agent wrote.",
   "atlas": [
    {
     "id": "AML.T0006",
     "name": "Active Scanning"
    },
    {
     "id": "AML.T0089",
     "name": "Process Discovery"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.discovery",
    "attack.t1046",
    "attack.t1040"
   ],
   "cves": [],
   "id": "5ab0c6d8-c202-5f02-b71c-f0228052c20d",
   "published": "2026-01-25",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/network-recon.md"
  },
  {
   "slug": "openclaw-claw-chain-full-sequence",
   "title": "Agent Skill Poisoning Chain Correlator",
   "url": "https://www.netzilo.com/threats/openclaw-claw-chain-full-sequence",
   "severity": "critical",
   "summary": "This rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then uses the agent's access to read credentials and send them out to an attacker-controlled destination.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0098",
     "name": "AI Agent Tool Credential Harvesting"
    },
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.execution",
    "attack.credential-access",
    "attack.exfiltration",
    "attack.lateral-movement"
   ],
   "cves": [
    "CVE-2026-44112",
    "CVE-2026-44118"
   ],
   "id": "netzilo-agent-skill-poison-chain-001",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/openclaw-claw-chain-full-sequence.md"
  },
  {
   "slug": "openclaw-cve-2026-44113-44112-sandbox-escape",
   "title": "CVE-2026-44113/44112 Sandbox Escape File Access",
   "url": "https://www.netzilo.com/threats/openclaw-cve-2026-44113-44112-sandbox-escape",
   "severity": "critical",
   "summary": "Two related flaws (CVE-2026-44113 and CVE-2026-44112) let a process escape the OpenClaw sandbox by exploiting a timing gap between a security check and the actual file access. This lets an attacker or compromised agent reach files outside the directory it was supposed to be confined to, either reading sensitive data or writing to unauthorized locations.",
   "atlas": [
    {
     "id": "AML.T0105",
     "name": "Escape to Host"
    },
    {
     "id": "AML.T0097",
     "name": "Virtualization/Sandbox Evasion"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.defense-impairment",
    "attack.t1036",
    "attack.credential-access"
   ],
   "cves": [
    "CVE-2026-44112",
    "CVE-2026-44113"
   ],
   "id": "netzilo-cve-2026-44113-44112-001",
   "published": "2026-04-01",
   "modified": "2026-04-01",
   "markdown": "https://www.netzilo.com/threats/openclaw-cve-2026-44113-44112-sandbox-escape.md"
  },
  {
   "slug": "openclaw-cve-2026-44115-heredoc-bypass",
   "title": "CVE-2026-44115 Heredoc Command Substitution Bypass",
   "url": "https://www.netzilo.com/threats/openclaw-cve-2026-44115-heredoc-bypass",
   "severity": "high",
   "summary": "OpenClaw checks the visible command a tool call uses, like 'cat', but does not look inside heredoc text blocks attached to that command. An attacker can hide a command substitution such as $(curl ... | bash) inside the heredoc body, so when the shell expands it, arbitrary code runs even though the outer command looked safe.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.defense-impairment",
    "attack.t1027"
   ],
   "cves": [
    "CVE-2026-44115"
   ],
   "id": "netzilo-cve-2026-44115-001",
   "published": "2026-04-01",
   "modified": "2026-04-01",
   "markdown": "https://www.netzilo.com/threats/openclaw-cve-2026-44115-heredoc-bypass.md"
  },
  {
   "slug": "openclaw-cve-2026-44118-owner-impersonation",
   "title": "CVE-2026-44118 Owner Impersonation via senderIsOwner",
   "url": "https://www.netzilo.com/threats/openclaw-cve-2026-44118-owner-impersonation",
   "severity": "critical",
   "summary": "Older versions of OpenClaw (before 2026.4.22) trust a simple flag called senderIsOwner=true without checking who actually sent it, as long as the connection comes from the same machine (loopback). Any process running locally can set this flag and be treated as the gateway owner, gaining elevated privileges it shouldn't have.",
   "atlas": [
    {
     "id": "AML.T0049",
     "name": "Exploit Public-Facing Application"
    }
   ],
   "owasp": [
    {
     "id": "ASI03",
     "name": "Identity and Impersonation"
    },
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1548",
    "attack.lateral-movement"
   ],
   "cves": [
    "CVE-2026-44118"
   ],
   "id": "netzilo-cve-2026-44118-001",
   "published": "2026-04-01",
   "modified": "2026-04-01",
   "markdown": "https://www.netzilo.com/threats/openclaw-cve-2026-44118-owner-impersonation.md"
  },
  {
   "slug": "openclaw-dangerous-exec",
   "title": "OpenClaw Remote Code Execution via Piped Script Download",
   "url": "https://www.netzilo.com/threats/openclaw-dangerous-exec",
   "severity": "critical",
   "summary": "An attacker hides instructions inside content an AI agent processes, causing the agent to fetch a script from the internet and run it immediately by piping it into a shell interpreter. This lets the attacker execute arbitrary code on whatever system the agent is operating on.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.stealth"
   ],
   "cves": [],
   "id": "76eb614c-cea3-5aaa-ae79-aeb242cb1f12",
   "published": "2026-02-07",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/openclaw-dangerous-exec.md"
  },
  {
   "slug": "openclaw-mcp-manipulation",
   "title": "MCP Server, Plugin or Skill Installed Outside a Tool Call",
   "url": "https://www.netzilo.com/threats/openclaw-mcp-manipulation",
   "severity": "medium",
   "summary": "AI agents normally register new server configs, plugins, or skills through a visible tool call that gets logged. This detects the same kind of configuration file appearing on disk through a different route - a script the agent generated and ran, a package installer's postinstall hook, or a direct download into a config folder - where no tool call ever shows what happened.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    },
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "LLM03",
     "name": "Supply Chain"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1543",
    "attack.initial-access",
    "attack.t1195.002"
   ],
   "cves": [],
   "id": "c6651188-df04-513f-a86f-35f898b4e92a",
   "published": "2026-02-26",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/openclaw-mcp-manipulation.md"
  },
  {
   "slug": "openclaw-network-exfiltration",
   "title": "OpenClaw Data Exfiltration via Network Upload",
   "url": "https://www.netzilo.com/threats/openclaw-network-exfiltration",
   "severity": "medium",
   "summary": "This detects when an OpenClaw AI agent runs commands like curl POST or wget --post to send data out to a remote server. That pattern can mean the agent is being used, tricked, or hijacked into sending sensitive files, code, or credentials somewhere outside the organisation's control.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1048"
   ],
   "cves": [],
   "id": "d6e3b11d-4b06-5574-8802-1c28bd4dd2db",
   "published": "2026-02-07",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/openclaw-network-exfiltration.md"
  },
  {
   "slug": "openclaw-prompt-injection",
   "title": "Injected Instructions in Tool Output Followed by Compliance",
   "url": "https://www.netzilo.com/threats/openclaw-prompt-injection",
   "severity": "high",
   "summary": "An AI agent that reads web pages, files, or other tool output can be tricked if that content secretly contains instructions written for the AI itself. If the agent then acts on those hidden instructions instead of the user's original request, it has been hijacked through its own tools.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    },
    {
     "id": "ASI06",
     "name": "Goal and Instruction Manipulation"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566",
    "attack.stealth"
   ],
   "cves": [],
   "id": "109b3a23-92b2-529f-b77c-8d4dd88f7e66",
   "published": "2026-02-26",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/openclaw-prompt-injection.md"
  },
  {
   "slug": "openclaw-session-spawn-abuse",
   "title": "Detached or Backgrounded Process Spawn",
   "url": "https://www.netzilo.com/threats/openclaw-session-spawn-abuse",
   "severity": "medium",
   "summary": "An AI agent can start a process using tools like nohup, disown, setsid, or a detached screen/tmux session, so the process survives after the agent's task ends. This detection flags such detached or backgrounded process launches, since anything the process does afterward can no longer be tied back to the original request.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "ASI09",
     "name": "Traceability and Accountability Gaps"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.stealth"
   ],
   "cves": [],
   "id": "376e4fd2-341f-5e11-b3fc-d76555ffa0fd",
   "published": "2026-02-26",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/openclaw-session-spawn-abuse.md"
  },
  {
   "slug": "openclaw-suspicious-file-write",
   "title": "OpenClaw Suspicious File Write to Sensitive Paths",
   "url": "https://www.netzilo.com/threats/openclaw-suspicious-file-write",
   "severity": "high",
   "summary": "This rule flags an AI coding or automation agent when it writes to files that control what runs automatically on a system \u2014 things like shell startup scripts, cron jobs, systemd services, LaunchAgents, or SSH authorized_keys. Writing to these locations is a classic way to make malicious code persist after a reboot or session ends.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.t1053"
   ],
   "cves": [],
   "id": "db43664e-2408-5e70-9b63-dcb0fabc8c5f",
   "published": "2026-02-07",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/openclaw-suspicious-file-write.md"
  },
  {
   "slug": "openclaw-suspicious-file-write-periodic",
   "title": "OpenClaw Suspicious File Write to Sensitive Paths (EDR Graph)",
   "url": "https://www.netzilo.com/threats/openclaw-suspicious-file-write-periodic",
   "severity": "high",
   "summary": "An AI agent (or a subprocess it spawned) writes to sensitive file paths on disk. This particular check catches writes that only show up in operating-system level monitoring, meaning they were made by a subprocess or in a way that bypassed the agent's own tool-call logging.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.t1053"
   ],
   "cves": [],
   "id": "db43664e-2408-5e70-9b63-dcb0fabc8c5f-p",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/openclaw-suspicious-file-write-periodic.md"
  },
  {
   "slug": "persistence",
   "title": "Persistence Mechanism Installation",
   "url": "https://www.netzilo.com/threats/persistence",
   "severity": "high",
   "summary": "This rule watches for an AI agent's command execution or file-editing tools being used to create mechanisms that run code automatically at startup or on a schedule. These mechanisms \u2014 cron jobs, launchd agents, systemd units, or shell profile edits \u2014 are a standard way attackers keep access to a system after their initial foothold.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1053",
    "attack.t1543",
    "attack.t1546"
   ],
   "cves": [],
   "id": "d12c1b8c-4ee7-5548-947b-a1627bdc98dc",
   "published": "2026-01-25",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/persistence.md"
  },
  {
   "slug": "persistence-periodic",
   "title": "Persistence Mechanism Installation (EDR Graph)",
   "url": "https://www.netzilo.com/threats/persistence-periodic",
   "severity": "high",
   "summary": "This detection watches for files being written to the specific system locations that let a program run automatically, such as at startup or on a schedule. Attackers use these locations to make sure their malicious code survives a reboot or keeps running without further action.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1053",
    "attack.t1543"
   ],
   "cves": [],
   "id": "d12c1b8c-4ee7-5548-947b-a1627bdc98dc-p",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/persistence-periodic.md"
  },
  {
   "slug": "pii-credit-card-ssn-redact",
   "title": "PII Credit Card and SSN Redaction",
   "url": "https://www.netzilo.com/threats/pii-credit-card-ssn-redact",
   "severity": "critical",
   "summary": "This rule watches text flowing through an AI agent for full credit card numbers (Visa, Mastercard, Amex, Discover) and US Social Security Numbers. When it finds one, it redacts everything except the last four digits before the content is shown, stored, or passed along.",
   "atlas": [
    {
     "id": "AML.T0057",
     "name": "LLM Data Leakage"
    }
   ],
   "owasp": [
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.exfiltration"
   ],
   "cves": [],
   "id": "netzilo-pii-cc-ssn-redact-001",
   "published": "2026-03-01",
   "modified": "2026-03-01",
   "markdown": "https://www.netzilo.com/threats/pii-credit-card-ssn-redact.md"
  },
  {
   "slug": "privilege-escalation",
   "title": "Privilege Escalation Attempt",
   "url": "https://www.netzilo.com/threats/privilege-escalation",
   "severity": "high",
   "summary": "This rule watches for common Linux techniques used to gain root-level access: running sudo, flipping the setuid bit on files, changing file ownership to root, or granting Linux capabilities to a binary. These are standard steps attackers take after getting a foothold on a machine, to turn limited access into full control.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1548"
   ],
   "cves": [],
   "id": "ecc81ba6-4c08-5171-845b-e65daf432843",
   "published": "2026-02-04",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/privilege-escalation.md"
  },
  {
   "slug": "proc-memory-read",
   "title": "Process Memory Read via /proc Filesystem",
   "url": "https://www.netzilo.com/threats/proc-memory-read",
   "severity": "critical",
   "summary": "Attackers can pull live secrets \u2014 AWS/GCP tokens, Kubernetes service-account credentials \u2014 straight out of a running process's memory instead of hunting for them in files on disk. This is done by reading special files under Linux's /proc filesystem (or /dev/mem) that expose a process's memory, environment variables, and open file handles.",
   "atlas": [
    {
     "id": "AML.T0090",
     "name": "OS Credential Dumping"
    },
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.collection",
    "attack.t1005"
   ],
   "cves": [],
   "id": "bcc3f1fe-0c5f-53d3-b7a4-0639619810be",
   "published": "2026-03-30",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/proc-memory-read.md"
  },
  {
   "slug": "prompt-injection-direct",
   "title": "Direct Prompt Injection Attempt",
   "url": "https://www.netzilo.com/threats/prompt-injection-direct",
   "severity": "critical",
   "summary": "This detects attempts to trick an AI agent into ignoring its safety instructions by typing commands directly into a chat or input field. Attackers use known jailbreak phrases and fake 'system override' language to try to make the AI act outside its intended rules.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0054",
     "name": "LLM Jailbreak"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    },
    {
     "id": "ASI06",
     "name": "Goal and Instruction Manipulation"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1190",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "eddcdc94-698c-577f-900d-28b1b5491a80",
   "published": "2026-02-16",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/prompt-injection-direct.md"
  },
  {
   "slug": "prompt-injection-evasion",
   "title": "Prompt Injection Evasion Technique Detection",
   "url": "https://www.netzilo.com/threats/prompt-injection-evasion",
   "severity": "critical",
   "summary": "This rule catches attempts to sneak malicious instructions past an AI agent by hiding them using text tricks rather than plain language. It looks for specific technical patterns that almost never occur in normal content, so alerts are highly reliable.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1027",
    "attack.initial-access",
    "attack.t1190"
   ],
   "cves": [],
   "id": "f2e8d341-7b9a-4c6f-a1e3-0d8b5c7f2e91",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/prompt-injection-evasion.md"
  },
  {
   "slug": "prompt-injection-exfil",
   "title": "Markdown Image Exfiltration Pattern",
   "url": "https://www.netzilo.com/threats/prompt-injection-exfil",
   "severity": "critical",
   "summary": "An AI system's output includes a markdown image tag whose URL contains encoded chunks of data. When a chat client or renderer fetches that image, it silently sends the encoded data to an attacker-controlled server just by loading the image.",
   "atlas": [
    {
     "id": "AML.T0057",
     "name": "LLM Data Leakage"
    },
    {
     "id": "AML.T0077",
     "name": "LLM Response Rendering"
    }
   ],
   "owasp": [
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1041",
    "attack.t1048"
   ],
   "cves": [],
   "id": "e6e58cd1-d05a-5512-b3fb-3b6a38784ad9",
   "published": "2026-02-16",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/prompt-injection-exfil.md"
  },
  {
   "slug": "prompt-injection-indirect",
   "title": "Indirect Prompt Injection in Retrieved Content",
   "url": "https://www.netzilo.com/threats/prompt-injection-indirect",
   "severity": "high",
   "summary": "AI agents that read web pages, documents, or other external content can be manipulated by text that isn't meant to be seen by humans. Attackers hide commands using invisible CSS, disguised Unicode characters, or fake system-prompt formatting, hoping the AI agent will read and obey them instead of its actual user.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    },
    {
     "id": "ASI06",
     "name": "Goal and Instruction Manipulation"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.stealth",
    "attack.t1564"
   ],
   "cves": [],
   "id": "24bc5b40-f601-5055-aa6d-0252c7a23a36",
   "published": "2026-02-16",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/prompt-injection-indirect.md"
  },
  {
   "slug": "python-download-exec",
   "title": "Python Download and Execute Remote Code",
   "url": "https://www.netzilo.com/threats/python-download-exec",
   "severity": "critical",
   "summary": "This detects a pattern where Python fetches code from a remote URL and executes it in the same step, instead of saving it to disk first. Attackers use this to run malicious code while avoiding detections that only watch for curl or wget downloads.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.command-and-control",
    "attack.t1105"
   ],
   "cves": [],
   "id": "5e6a3d2e-0983-5e22-9fb1-6cfc27baa291",
   "published": "2026-02-26",
   "modified": "2026-02-26",
   "markdown": "https://www.netzilo.com/threats/python-download-exec.md"
  },
  {
   "slug": "rag-image-exfiltration",
   "title": "Zero-Click RAG Exfiltration via Image URL",
   "url": "https://www.netzilo.com/threats/rag-image-exfiltration",
   "severity": "critical",
   "summary": "An attacker hides instructions inside a document that an AI assistant later reads and summarizes (a RAG system). The hidden instructions tell the AI to take sensitive information from its context and stuff it into the query string of an image URL, so simply rendering the AI's response causes the browser to send that data to an attacker-controlled server.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    },
    {
     "id": "AML.T0070",
     "name": "RAG Poisoning"
    },
    {
     "id": "AML.T0077",
     "name": "LLM Response Rendering"
    }
   ],
   "owasp": [
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    },
    {
     "id": "LLM05",
     "name": "Improper Output Handling"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1048"
   ],
   "cves": [],
   "id": "30d14136-6ae1-5194-bc34-ed23d62c8fdc",
   "published": "2026-03-16",
   "modified": "2026-03-16",
   "markdown": "https://www.netzilo.com/threats/rag-image-exfiltration.md"
  },
  {
   "slug": "rce-injection",
   "title": "Remote Code Execution via Piped Script Download",
   "url": "https://www.netzilo.com/threats/rce-injection",
   "severity": "critical",
   "summary": "This detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt injection attacks turn a compromised agent into a full code execution foothold.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.stealth"
   ],
   "cves": [],
   "id": "c65a9620-e989-5a2c-b993-c81a6c049a84",
   "published": "2026-01-25",
   "modified": "2026-04-09",
   "markdown": "https://www.netzilo.com/threats/rce-injection.md"
  },
  {
   "slug": "recon-then-exfil",
   "title": "Reconnaissance Tools Followed by Data Exfiltration",
   "url": "https://www.netzilo.com/threats/recon-then-exfil",
   "severity": "high",
   "summary": "This detects a pattern where an AI agent first inspects the filesystem and environment, then uses network tools to send data out. The sequencing suggests a deliberate two-stage attack: look around first, then exfiltrate what was found.",
   "atlas": [
    {
     "id": "AML.T0089",
     "name": "Process Discovery"
    },
    {
     "id": "AML.T0037",
     "name": "Data from Local System"
    },
    {
     "id": "AML.T0025",
     "name": "Exfiltration via Cyber Means"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1041",
    "attack.discovery",
    "attack.t1046"
   ],
   "cves": [],
   "id": "6222d663-59cc-549d-b0f5-34a787eb76aa",
   "published": "2026-03-18",
   "modified": "2026-03-18",
   "markdown": "https://www.netzilo.com/threats/recon-then-exfil.md"
  },
  {
   "slug": "recursive-agent-loop-budget-exhaustion",
   "title": "Recursive Agent Loop and Token Budget Exhaustion",
   "url": "https://www.netzilo.com/threats/recursive-agent-loop-budget-exhaustion",
   "severity": "medium",
   "summary": "This detects an AI agent that repeatedly calls the same tool with the exact same arguments, very fast, without making any real progress. It's the signature of a runaway agent loop that wastes compute, API calls, or money without the attacker (or the agent's own logic) achieving anything new.",
   "atlas": [
    {
     "id": "AML.T0034",
     "name": "Cost Harvesting"
    }
   ],
   "owasp": [
    {
     "id": "ASI10",
     "name": "Resource Exhaustion and Denial of Wallet"
    }
   ],
   "attack": [
    "attack.impact",
    "attack.t1499"
   ],
   "cves": [],
   "id": "6b1f2c9d-7a54-4de8-9c31-2f80a4d5e713",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/recursive-agent-loop-budget-exhaustion.md"
  },
  {
   "slug": "reverse-shell",
   "title": "Reverse Shell Attempt",
   "url": "https://www.netzilo.com/threats/reverse-shell",
   "severity": "critical",
   "summary": "This detects commands that try to open a remote, interactive shell connection back to an attacker-controlled machine. It watches for known reverse-shell patterns built with common tools like bash, python, perl, netcat (nc), and socat.",
   "atlas": [
    {
     "id": "AML.T0072",
     "name": "Reverse Shell"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.persistence",
    "attack.t1573"
   ],
   "cves": [],
   "id": "74dee137-ffb8-54c8-862f-4a98a61f63ee",
   "published": "2026-02-17",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/reverse-shell.md"
  },
  {
   "slug": "rule-of-two",
   "title": "Rule of Two \u2014 Exfiltration Chain Detection",
   "url": "https://www.netzilo.com/threats/rule-of-two",
   "severity": "critical",
   "summary": "This detects a pattern where an AI agent, within a short window of time, pulls in outside content, reads sensitive local data, and then sends data out externally. That combination is a known way to trick AI agents into stealing information and sending it to an attacker.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.collection",
    "attack.t1048"
   ],
   "cves": [],
   "id": "netzilo-rule-of-two-001",
   "published": "2026-03-01",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/rule-of-two.md"
  },
  {
   "slug": "rules-file-backdoor",
   "title": "Hidden Unicode in Agent Instruction Files",
   "url": "https://www.netzilo.com/threats/rules-file-backdoor",
   "severity": "high",
   "summary": "Attackers can plant special Unicode characters \u2014 invisible spacing marks or text-direction overrides \u2014 inside files like CLAUDE.md or .cursorrules. A human reviewing the file in a normal editor or diff sees ordinary, harmless-looking instructions, but the AI agent reading the same file receives different, hidden text.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "ASI06",
     "name": "Goal and Instruction Manipulation"
    },
    {
     "id": "ASI04",
     "name": "Memory and Context Poisoning"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.stealth",
    "attack.t1564"
   ],
   "cves": [],
   "id": "78b34f4d-5fde-57a5-905d-00fd92ed359c",
   "published": "2026-03-30",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/rules-file-backdoor.md"
  },
  {
   "slug": "rules-file-backdoor-periodic",
   "title": "Hidden Unicode in Agent Instruction Files (EDR Graph)",
   "url": "https://www.netzilo.com/threats/rules-file-backdoor-periodic",
   "severity": "medium",
   "summary": "AI coding agents read files like CLAUDE.md or .cursorrules for instructions. Attackers can hide invisible or misleading Unicode characters in these files to manipulate the agent's behavior, and this rule catches the case where that write happens indirectly, through a subprocess the agent itself spawned, rather than through the agent's own file-write tool call.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "ASI06",
     "name": "Goal and Instruction Manipulation"
    },
    {
     "id": "ASI09",
     "name": "Traceability and Accountability Gaps"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.stealth",
    "attack.t1564"
   ],
   "cves": [],
   "id": "78b34f4d-5fde-57a5-905d-00fd92ed359c-p",
   "published": "2026-08-03",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/rules-file-backdoor-periodic.md"
  },
  {
   "slug": "scripting-tool-substitution",
   "title": "Scripting Language Tool Substitution",
   "url": "https://www.netzilo.com/threats/scripting-tool-substitution",
   "severity": "high",
   "summary": "Attackers who can't run tools like curl, nmap, or nc directly (because they're blocked or monitored) fall back on writing small Python, Node.js, or Ruby scripts that do the same job. Since detection rules are often tied to specific tool names, this substitution can slip past them.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059"
   ],
   "cves": [],
   "id": "ba8e8ccf-b67b-5c55-8054-b55a52f51aa3",
   "published": "2026-02-26",
   "modified": "2026-04-09",
   "markdown": "https://www.netzilo.com/threats/scripting-tool-substitution.md"
  },
  {
   "slug": "sensitive-proc-read",
   "title": "Sensitive Proc Filesystem Read",
   "url": "https://www.netzilo.com/threats/sensitive-proc-read",
   "severity": "high",
   "summary": "This rule flags attempts to read sensitive files under the Linux /proc filesystem, such as /proc/self/environ, which expose a process's environment variables and memory maps. Attackers or misbehaving AI agents use this technique to pull secrets like API keys or tokens after being blocked from listing environment variables directly.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0089",
     "name": "Process Discovery"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.credential-access",
    "attack.t1552.001",
    "attack.discovery",
    "attack.t1082"
   ],
   "cves": [],
   "id": "b8e2a4f1-7c93-5d1e-a6b4-3f9d0e8c5a72",
   "published": "2026-03-02",
   "modified": "2026-03-02",
   "markdown": "https://www.netzilo.com/threats/sensitive-proc-read.md"
  },
  {
   "slug": "sensitive-system-file-read",
   "title": "Sensitive System File Read",
   "url": "https://www.netzilo.com/threats/sensitive-system-file-read",
   "severity": "high",
   "summary": "This detects an AI agent or automated process reading files that hold Linux account and authentication data, such as /etc/passwd, /etc/shadow, /etc/sudoers, the auth log, or root's authorized_keys. Reading these files is a common early step attackers take to enumerate accounts and find ways to escalate privileges.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0089",
     "name": "Process Discovery"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.discovery",
    "attack.t1087",
    "attack.credential-access",
    "attack.t1552"
   ],
   "cves": [],
   "id": "cb33c5f1-4bd1-5d36-a9b7-3e56737f928b",
   "published": "2026-07-03",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/sensitive-system-file-read.md"
  },
  {
   "slug": "sensitive-system-file-read-periodic",
   "title": "Sensitive System File Read (EDR Graph)",
   "url": "https://www.netzilo.com/threats/sensitive-system-file-read-periodic",
   "severity": "medium",
   "summary": "This detection catches an AI agent (or a subprocess it spawned) reading sensitive system files like /etc/passwd, sudoers, or authorized_keys. It's a periodic check rather than a live alert, so it fires with a delay.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0037",
     "name": "Data from Local System"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.discovery",
    "attack.t1087",
    "attack.credential-access",
    "attack.t1552"
   ],
   "cves": [],
   "id": "cb33c5f1-4bd1-5d36-a9b7-3e56737f928b-p",
   "published": "2026-08-03",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/sensitive-system-file-read-periodic.md"
  },
  {
   "slug": "session-velocity-anomaly",
   "title": "Unusual Tool Call Velocity in Session",
   "url": "https://www.netzilo.com/threats/session-velocity-anomaly",
   "severity": "medium",
   "summary": "This detects sessions where an AI agent's tools are invoked far more often than normal, 20 or more times in a single session. A high call count can mean someone is scripting an attack or probing the agent's tools automatically rather than using it interactively.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI10",
     "name": "Resource Exhaustion and Denial of Wallet"
    }
   ],
   "attack": [
    "attack.discovery",
    "attack.t1046"
   ],
   "cves": [],
   "id": "d2c6956f-7960-5f83-9886-15cab99fcaab",
   "published": "2026-03-18",
   "modified": "2026-03-18",
   "markdown": "https://www.netzilo.com/threats/session-velocity-anomaly.md"
  },
  {
   "slug": "shell-config-modification",
   "title": "Shell Configuration Modification",
   "url": "https://www.netzilo.com/threats/shell-config-modification",
   "severity": "high",
   "summary": "This rule flags attempts to modify files like .bashrc, .bash_profile, or .ssh/authorized_keys through an AI agent's command execution or file editing tools. These files are common places attackers plant persistence mechanisms so their access survives a reboot or session end.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546"
   ],
   "cves": [],
   "id": "1e785c77-6d77-5c79-ae24-6a389f9ef7f1",
   "published": "2026-02-04",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/shell-config-modification.md"
  },
  {
   "slug": "shell-config-modification-periodic",
   "title": "Shell Configuration Modification (EDR Graph)",
   "url": "https://www.netzilo.com/threats/shell-config-modification-periodic",
   "severity": "high",
   "summary": "This rule watches for changes to files like .bashrc, .bash_profile, .zshrc, or authorized_keys. Attackers modify these files to run their own commands automatically or to add their own SSH key, so they can get back in later.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546"
   ],
   "cves": [],
   "id": "1e785c77-6d77-5c79-ae24-6a389f9ef7f1-p",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/shell-config-modification-periodic.md"
  },
  {
   "slug": "shell-eval-obfuscation",
   "title": "Shell Eval and Variable Obfuscation",
   "url": "https://www.netzilo.com/threats/shell-eval-obfuscation",
   "severity": "high",
   "summary": "This detects shell commands that are deliberately disguised to avoid being recognized by security tools. Attackers hide the real command using tricks like variable substitution, eval, or encoding it as hex/octal bytes piped into a shell interpreter.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1027",
    "attack.execution",
    "attack.t1059"
   ],
   "cves": [],
   "id": "b1a10452-843b-540d-827a-aa3bcded8ba9",
   "published": "2026-02-26",
   "modified": "2026-02-26",
   "markdown": "https://www.netzilo.com/threats/shell-eval-obfuscation.md"
  },
  {
   "slug": "silent-model-substitution",
   "title": "LLM Silent Model Substitution To Unmanaged Or Uncensored Model",
   "url": "https://www.netzilo.com/threats/silent-model-substitution",
   "severity": "high",
   "summary": "An AI agent that starts out using an approved, safety-tuned model can have its configuration rewritten so that later requests go to a different model instead \u2014 one without the usual safety guardrails, or one running on infrastructure nobody is managing. This detection catches the moment a request in an existing session shows that swap has happened.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    }
   ],
   "owasp": [
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.defense-evasion",
    "attack.t1562"
   ],
   "cves": [],
   "id": "7c1e4a92-3f6b-4d58-9a0e-2b5f81c47d63",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/silent-model-substitution.md"
  },
  {
   "slug": "skillspector-autonomous-no-confirm",
   "title": "Agent Instructed to Act Without User Confirmation",
   "url": "https://www.netzilo.com/threats/skillspector-autonomous-no-confirm",
   "severity": "high",
   "summary": "Some AI agent configurations (skill manifests, system prompts) explicitly instruct the agent to carry out sensitive actions without checking with a human first. This rule flags that instruction pattern, which removes a safety checkpoint an operator would normally rely on.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    },
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    }
   ],
   "attack": [
    "attack.impact",
    "attack.t1485",
    "attack.privilege-escalation"
   ],
   "cves": [],
   "id": "f7b1e645-8a5c-4b2f-e7b6-1a4c9b6f5d38",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-autonomous-no-confirm.md"
  },
  {
   "slug": "skillspector-context-leakage",
   "title": "Conversation Context Leakage to External Endpoint",
   "url": "https://www.netzilo.com/threats/skillspector-context-leakage",
   "severity": "high",
   "summary": "An attacker gets an AI agent to package up the current conversation\u2014user messages, session context, prior turns\u2014and send it to a server the attacker controls. This turns a normal chat session into a data leak without the user noticing.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0057",
     "name": "LLM Data Leakage"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1041",
    "attack.collection",
    "attack.t1119"
   ],
   "cves": [],
   "id": "b5d9a423-6c3e-4d0b-b5d4-9c2e7d4b3f16",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-context-leakage.md"
  },
  {
   "slug": "skillspector-context-window-stuffing",
   "title": "Context Window Stuffing Attack",
   "url": "https://www.netzilo.com/threats/skillspector-context-window-stuffing",
   "severity": "high",
   "summary": "AI models can only 'remember' a limited amount of text at once, called a context window. This attack floods that window with repetitive or filler text so the model's original safety instructions get pushed out and are effectively forgotten.",
   "atlas": [
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI04",
     "name": "Memory and Context Poisoning"
    },
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "b9d3a867-0c7e-4d4b-a9d8-3c6e1d8b7f50",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-context-window-stuffing.md"
  },
  {
   "slug": "skillspector-excessive-permissions",
   "title": "Excessive Permission Grant in Skill Manifest",
   "url": "https://www.netzilo.com/threats/skillspector-excessive-permissions",
   "severity": "medium",
   "summary": "Some AI 'skills' or plug-ins declare permissions in their manifest or system prompt that go well beyond what their stated job requires \u2014 things like wildcard file access or full system control. This is a sign the skill is either poorly designed or intentionally built to gain more access than it should have.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    },
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1078"
   ],
   "cves": [],
   "id": "e8a2d756-9f6b-4a3e-e8a7-2f5b0a7f6c49",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-excessive-permissions.md"
  },
  {
   "slug": "skillspector-filesystem-enumeration",
   "title": "File System Enumeration for Credentials and Secrets",
   "url": "https://www.netzilo.com/threats/skillspector-filesystem-enumeration",
   "severity": "high",
   "summary": "This rule flags when an AI agent's tool calls are used to search through a file system for things like SSH keys, cloud config files, and other credential stores. That kind of scanning is a common first step before someone tries to steal those credentials.",
   "atlas": [
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0037",
     "name": "Data from Local System"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.discovery",
    "attack.t1083",
    "attack.credential-access",
    "attack.t1552"
   ],
   "cves": [],
   "id": "a4c8f312-5b2d-4c9a-a4c3-8b1d6c3a2e05",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-filesystem-enumeration.md"
  },
  {
   "slug": "skillspector-mcp-hidden-instructions",
   "title": "Hidden Instructions in MCP Skill Metadata",
   "url": "https://www.netzilo.com/threats/skillspector-mcp-hidden-instructions",
   "severity": "high",
   "summary": "MCP skills advertise themselves to AI agents using metadata like names, descriptions, and parameter text. This detection looks for hidden content in that metadata \u2014 HTML comments, invisible zero-width characters, base64 blobs, or data URIs \u2014 that a human skimming the manifest would never notice but that an AI agent will read and act on.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "c4e8b312-5d2f-4e9c-b4e3-8d1f6e3c2a05",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-mcp-hidden-instructions.md"
  },
  {
   "slug": "skillspector-mcp-param-injection",
   "title": "MCP Parameter Description Injection",
   "url": "https://www.netzilo.com/threats/skillspector-mcp-param-injection",
   "severity": "high",
   "summary": "AI agents that use tools defined by the Model Context Protocol (MCP) read tool descriptions, including parameter descriptions, before deciding how to call a tool. An attacker can write hidden instructions into a parameter description so that when the agent reads the tool schema, it follows the attacker's directive instead of the user's intent.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566",
    "attack.stealth"
   ],
   "cves": [],
   "id": "d5f9c423-6e3a-4f0d-c5f4-9e2a7f4d3b16",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-mcp-param-injection.md"
  },
  {
   "slug": "skillspector-mcp-unicode-deception",
   "title": "MCP Tool Description Unicode Confusable Deception",
   "url": "https://www.netzilo.com/threats/skillspector-mcp-unicode-deception",
   "severity": "high",
   "summary": "Some tools registered with AI agents (via the Model Context Protocol, or MCP) describe themselves using letters that look like normal English but are actually Cyrillic, Greek, or other Unicode lookalikes. This lets an attacker make a tool's description look trustworthy while hiding its real, different meaning from anyone reading it quickly.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1027",
    "attack.initial-access",
    "attack.t1190"
   ],
   "cves": [],
   "id": "b3f7a291-4c1e-4d8b-a3f2-7c0e5d2b1f94",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-mcp-unicode-deception.md"
  },
  {
   "slug": "skillspector-memory-manipulation",
   "title": "Agent Memory and Identity Manipulation",
   "url": "https://www.netzilo.com/threats/skillspector-memory-manipulation",
   "severity": "high",
   "summary": "Some AI agents keep memory or state between sessions so they remember context. This rule flags instructions that try to overwrite that stored memory, reset the agent's identity, or plant false 'memories' that persist and affect future sessions.",
   "atlas": [
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI04",
     "name": "Memory and Context Poisoning"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.stealth"
   ],
   "cves": [],
   "id": "c0e4b978-1d8f-4e5c-b0e9-4d7f2e9c8a61",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-memory-manipulation.md"
  },
  {
   "slug": "skillspector-package-typosquatting",
   "title": "Typosquatting Package Name in Install Command",
   "url": "https://www.netzilo.com/threats/skillspector-package-typosquatting",
   "severity": "critical",
   "summary": "This detects package install commands (pip, npm, etc.) that reference known lookalike package names \u2014 ones that differ from a popular package by a character or two. Attackers publish these lookalikes hoping for accidental installs, including cases where an AI assistant suggests the wrong package name.",
   "atlas": [
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    }
   ],
   "owasp": [
    {
     "id": "LLM03",
     "name": "Supply Chain"
    },
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1195",
    "attack.supply-chain"
   ],
   "cves": [],
   "id": "c6e0b534-7d4f-4e1c-c6e5-0d3f8e5c4a27",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-package-typosquatting.md"
  },
  {
   "slug": "skillspector-persistent-context-injection",
   "title": "Persistent Context Injection in Agent Instructions",
   "url": "https://www.netzilo.com/threats/skillspector-persistent-context-injection",
   "severity": "high",
   "summary": "Some prompts don't just try to trick an AI agent once \u2014 they try to make the trick stick, by phrasing injected content as a permanent rule the agent should 'always remember' or follow 'from now on.' This turns a one-time manipulation into lasting behavioral hijacking.",
   "atlas": [
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI04",
     "name": "Memory and Context Poisoning"
    },
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.stealth"
   ],
   "cves": [],
   "id": "b1d5a089-2c9b-4d6e-b1d0-5c3b4a1d0c72",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-persistent-context-injection.md"
  },
  {
   "slug": "skillspector-scope-creep",
   "title": "Agent Scope Creep \u2014 General Purpose Expansion",
   "url": "https://www.netzilo.com/threats/skillspector-scope-creep",
   "severity": "medium",
   "summary": "This rule looks for text inside an AI agent's configuration or instructions that tries to push it beyond its intended job \u2014 telling it to 'handle everything' or act as a general-purpose assistant instead of the narrow task it was built for. That kind of instruction, whether planted by an attacker or added carelessly, makes the agent capable of far more than intended.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    },
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI06",
     "name": "Goal and Instruction Manipulation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.impact",
    "attack.privilege-escalation"
   ],
   "cves": [],
   "id": "a8c2f756-9b6d-4c3a-f8c7-2b5d0c7a6e49",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-scope-creep.md"
  },
  {
   "slug": "skillspector-self-modification",
   "title": "Agent Self-Modification Attempt",
   "url": "https://www.netzilo.com/threats/skillspector-self-modification",
   "severity": "critical",
   "summary": "This detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a direct instruction telling the agent to edit itself is a red flag.",
   "atlas": [
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    },
    {
     "id": "AML.T0107",
     "name": "Exploitation for Defense Evasion"
    }
   ],
   "owasp": [
    {
     "id": "ASI01",
     "name": "Agent Authorization and Control Hijacking"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.defense-impairment",
    "attack.t1562"
   ],
   "cves": [],
   "id": "d1f5c089-2e9a-4f6d-c1f0-5e8a3f0d9b72",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-self-modification.md"
  },
  {
   "slug": "skillspector-tool-chaining-bypass",
   "title": "Tool Chaining to Bypass Safety Controls",
   "url": "https://www.netzilo.com/threats/skillspector-tool-chaining-bypass",
   "severity": "high",
   "summary": "An AI agent that can call multiple tools can be manipulated into running a sequence of individually harmless operations that together produce a harmful result. This detection looks for that pattern, or for instructions that openly ask the agent to use tool chaining to get around safety checks.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.defense-impairment"
   ],
   "cves": [],
   "id": "e2a6d190-3f0b-4a7e-d2a1-6f9b4a1e0c83",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-tool-chaining-bypass.md"
  },
  {
   "slug": "skillspector-tool-param-abuse",
   "title": "Dangerous Tool Parameter Abuse",
   "url": "https://www.netzilo.com/threats/skillspector-tool-param-abuse",
   "severity": "critical",
   "summary": "This rule flags when an AI agent invokes a tool using parameter values that are known to be risky, such as enabling shell injection, forcing destructive deletes, disabling SSL certificate checks, or setting SUID permissions. These are the kinds of arguments that turn a normal tool call into something that can compromise a system or destroy data.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.impact",
    "attack.t1485"
   ],
   "cves": [],
   "id": "a0c4f978-1b8d-4c5a-a0c9-4b2d3f0a9b61",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-tool-param-abuse.md"
  },
  {
   "slug": "skillspector-trigger-abuse",
   "title": "Skill Trigger Keyword Abuse",
   "url": "https://www.netzilo.com/threats/skillspector-trigger-abuse",
   "severity": "high",
   "summary": "Some AI agent 'skills' declare activation triggers so broad they fire on almost anything a user types, or word them to imitate built-in commands, or use urgent/emotional phrasing designed to make the agent invoke them at sensitive moments. This lets a malicious skill quietly insert itself into normal agent traffic instead of only running when genuinely needed.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "LLM03",
     "name": "Supply Chain"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566",
    "attack.collection",
    "attack.t1119"
   ],
   "cves": [],
   "id": "f9b3e867-0a7c-4b4f-f9b8-3a6c1b8a7d50",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-trigger-abuse.md"
  },
  {
   "slug": "skillspector-unbounded-resource",
   "title": "Unbounded Resource Access in Agent Instructions",
   "url": "https://www.netzilo.com/threats/skillspector-unbounded-resource",
   "severity": "medium",
   "summary": "This rule flags instructions given to an AI agent that tell it to keep calling APIs, retrying failed operations, or consuming compute/memory without any cap, timeout, or quota. That kind of unrestricted behavior can knock over backend services or run up huge cloud bills before anyone notices.",
   "atlas": [
    {
     "id": "AML.T0034",
     "name": "Cost Harvesting"
    }
   ],
   "owasp": [
    {
     "id": "LLM10",
     "name": "Unbounded Consumption"
    },
    {
     "id": "ASI10",
     "name": "Resource Exhaustion and Denial of Wallet"
    }
   ],
   "attack": [
    "attack.impact",
    "attack.t1498",
    "attack.resource-development"
   ],
   "cves": [],
   "id": "c2e6b190-3d0c-4e7f-c2e1-6d4c5b2e1d83",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-unbounded-resource.md"
  },
  {
   "slug": "skillspector-unpinned-dependency-install",
   "title": "Unpinned or Latest Dependency Installation",
   "url": "https://www.netzilo.com/threats/skillspector-unpinned-dependency-install",
   "severity": "medium",
   "summary": "Package installers can be told to grab whatever the newest version of a library is, instead of a specific, known version. If the software registry serving that package is later compromised, the next install silently pulls in malicious code.",
   "atlas": [
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    }
   ],
   "owasp": [
    {
     "id": "LLM03",
     "name": "Supply Chain"
    },
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1195",
    "attack.supply-chain"
   ],
   "cves": [],
   "id": "d7f1c645-8e5a-4f2d-d7f6-1e4a9f6d5b38",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-unpinned-dependency-install.md"
  },
  {
   "slug": "skillspector-unrestricted-tool-access",
   "title": "Unrestricted Tool Access Grant in Agent Instructions",
   "url": "https://www.netzilo.com/threats/skillspector-unrestricted-tool-access",
   "severity": "medium",
   "summary": "Some AI agent configurations tell the agent it can use any tool available, instead of listing only the tools it actually needs. This detection flags that pattern in skill manifests or system prompts, because it gives an attacker far more to work with if the agent is later manipulated.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0081",
     "name": "Modify AI Agent Configuration"
    }
   ],
   "owasp": [
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.privilege-escalation",
    "attack.t1078",
    "attack.defense-impairment"
   ],
   "cves": [],
   "id": "e6a0d534-7f4b-4a1e-d6a5-0f3b8a5e4c27",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-unrestricted-tool-access.md"
  },
  {
   "slug": "skillspector-unsafe-defaults",
   "title": "Unsafe Security Defaults in Agent Tool Calls",
   "url": "https://www.netzilo.com/threats/skillspector-unsafe-defaults",
   "severity": "high",
   "summary": "An AI agent that can call tools or run skills may be instructed\u2014by a malicious skill or an injected prompt\u2014to weaken security defaults instead of doing its actual job. This includes turning off TLS certificate checks, skipping authentication, opening file permissions to everyone, or allowing any website to make cross-origin requests.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.defense-impairment",
    "attack.t1562",
    "attack.credential-access"
   ],
   "cves": [],
   "id": "f3b7e201-4a1c-4b8f-e3b2-7a0c5b2f1d94",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/skillspector-unsafe-defaults.md"
  },
  {
   "slug": "steganographic-exfil",
   "title": "Steganographic Data Hiding",
   "url": "https://www.netzilo.com/threats/steganographic-exfil",
   "severity": "high",
   "summary": "This rule looks for the use of steganography and file-carving tools, plus metadata editors, to conceal data inside media files like images. Attackers do this to smuggle stolen data past network monitoring, since the payload is buried inside what looks like an ordinary picture or its EXIF tags.",
   "atlas": [
    {
     "id": "AML.T0074",
     "name": "Masquerading"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1048",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "083d7427-a932-5e34-85b8-0867ad7eb18c",
   "published": "2026-03-23",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/steganographic-exfil.md"
  },
  {
   "slug": "subprocess-os-exec",
   "title": "Subprocess and OS Exec-Family Call",
   "url": "https://www.netzilo.com/threats/subprocess-os-exec",
   "severity": "medium",
   "summary": "This rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new processes and run arbitrary shell commands, which is a common way to break out of an intended task and run something else on the host.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM06",
     "name": "Excessive Agency"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059"
   ],
   "cves": [],
   "id": "22b3c4d5-e6f7-4a89-0123-b4c5d6e7f8a9",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/subprocess-os-exec.md"
  },
  {
   "slug": "suspicious-process-exec",
   "title": "Suspicious Process Execution by Agent",
   "url": "https://www.netzilo.com/threats/suspicious-process-exec",
   "severity": "critical",
   "summary": "An AI agent with shell access runs a command that launches known hacking tools or dangerous command patterns, such as piping downloaded scripts straight into a shell. This is caught at the operating system level when the process actually executes, not just when a request is intercepted.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0072",
     "name": "Reverse Shell"
    },
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.command-and-control",
    "attack.t1573"
   ],
   "cves": [],
   "id": "a8b3c4d5-e6f7-5891-b2c3-d4e5f6a7b8c9",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/suspicious-process-exec.md"
  },
  {
   "slug": "system-file-tampering",
   "title": "System File Modification",
   "url": "https://www.netzilo.com/threats/system-file-tampering",
   "severity": "critical",
   "summary": "This rule flags an AI coding or automation agent when it writes or overwrites files in sensitive system locations like /etc/ or /usr/local/bin/. It catches this whether done through shell redirect commands or through the agent's own file-editing tools.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1543"
   ],
   "cves": [],
   "id": "89404989-df81-5ae1-9b23-d9e845e9be65",
   "published": "2026-02-04",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/system-file-tampering.md"
  },
  {
   "slug": "system-file-tampering-periodic",
   "title": "System File Modification (EDR Graph)",
   "url": "https://www.netzilo.com/threats/system-file-tampering-periodic",
   "severity": "critical",
   "summary": "This detects file writes to sensitive system locations like /etc/, /usr/bin/, and /usr/local/bin/. These directories hold configuration files and executable programs that control how a system behaves, so unexpected changes here are a strong sign of tampering.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1543"
   ],
   "cves": [],
   "id": "89404989-df81-5ae1-9b23-d9e845e9be65-p",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/system-file-tampering-periodic.md"
  },
  {
   "slug": "taint-credential-exfil",
   "title": "Credential File Read Followed by External HTTP Request",
   "url": "https://www.netzilo.com/threats/taint-credential-exfil",
   "severity": "critical",
   "summary": "This detects a two-step pattern: an AI agent process reads a sensitive credential file \u2014 an SSH key, an .aws/credentials file, a .env file, or browser saved passwords \u2014 and then makes an outbound HTTP request to an external host. That sequence matches how stolen credentials get exfiltrated: read first, then send.",
   "atlas": [
    {
     "id": "AML.T0083",
     "name": "Credentials from AI Agent Configuration"
    },
    {
     "id": "AML.T0055",
     "name": "Unsecured Credentials"
    },
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1041",
    "attack.credential-access",
    "attack.t1552"
   ],
   "cves": [],
   "id": "44d5e6f7-a8b9-4c01-2345-d6e7f8a9b0c1",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/taint-credential-exfil.md"
  },
  {
   "slug": "taint-file-exfil",
   "title": "Sensitive File Read Followed by External Data Transmission",
   "url": "https://www.netzilo.com/threats/taint-file-exfil",
   "severity": "high",
   "summary": "This rule flags a sequence where an AI agent first opens a sensitive file \u2014 source code, configs, documents, or similar \u2014 and then makes an outbound network connection shortly after. That pattern matches how an attacker or a compromised agent would exfiltrate data it just read.",
   "atlas": [
    {
     "id": "AML.T0086",
     "name": "Exfiltration via AI Agent Tool Invocation"
    }
   ],
   "owasp": [
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    },
    {
     "id": "LLM02",
     "name": "Sensitive Information Disclosure"
    }
   ],
   "attack": [
    "attack.exfiltration",
    "attack.t1041",
    "attack.collection",
    "attack.t1005"
   ],
   "cves": [],
   "id": "55e6f7a8-b9c0-4d12-3456-e7f8a9b0c1d2",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/taint-file-exfil.md"
  },
  {
   "slug": "taint-input-to-exec",
   "title": "External Network Input Followed by Process Execution",
   "url": "https://www.netzilo.com/threats/taint-input-to-exec",
   "severity": "high",
   "summary": "This detects a two-step pattern where an AI agent first pulls content from a remote web address and then executes a program shortly after. That sequence is the classic shape of a download-and-execute attack, where an attacker gets malicious content run as code by getting the agent to fetch and then act on it.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    },
    {
     "id": "AML.T0011",
     "name": "User Execution"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    },
    {
     "id": "LLM05",
     "name": "Improper Output Handling"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.initial-access",
    "attack.t1195"
   ],
   "cves": [],
   "id": "66f7a8b9-c0d1-4e23-4567-f8a9b0c1d2e3",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/taint-input-to-exec.md"
  },
  {
   "slug": "tool-output-ansi-injection",
   "title": "ANSI Escape Injection in Tool Output",
   "url": "https://www.netzilo.com/threats/tool-output-ansi-injection",
   "severity": "medium",
   "summary": "A tool that an AI agent calls can return raw terminal control codes instead of plain text. These codes can rewrite or hide parts of the displayed output, letting an attacker hide instructions inside data the human never sees but the model still reads.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    },
    {
     "id": "AML.T0068",
     "name": "LLM Prompt Obfuscation"
    }
   ],
   "owasp": [
    {
     "id": "LLM05",
     "name": "Improper Output Handling"
    },
    {
     "id": "ASI02",
     "name": "Tool Misuse and Exploitation"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "netzilo-tool-output-ansi-injection-001",
   "published": "2026-08-03",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/tool-output-ansi-injection.md"
  },
  {
   "slug": "tool-registry-tampering",
   "title": "Tool Registry Description Tampering with Embedded Instructions",
   "url": "https://www.netzilo.com/threats/tool-registry-tampering",
   "severity": "high",
   "summary": "An attacker edits the text description of a tool in an AI agent's tool registry so that it reads like an instruction to the AI model, not documentation for a human. Because AI agents often treat tool descriptions as trusted context, this can trick the model into calling the tool with attacker-chosen arguments or skipping intended safety steps.",
   "atlas": [
    {
     "id": "AML.T0110",
     "name": "AI Agent Tool Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    },
    {
     "id": "LLM03",
     "name": "Supply Chain"
    }
   ],
   "attack": [
    "attack.stealth",
    "attack.t1195.002"
   ],
   "cves": [],
   "id": "20812cdc-0a02-53f1-aabb-0aba1857547d",
   "published": "2026-03-16",
   "modified": "2026-03-16",
   "markdown": "https://www.netzilo.com/threats/tool-registry-tampering.md"
  },
  {
   "slug": "untrusted-skill-install",
   "title": "Untrusted Package or Skill Installation",
   "url": "https://www.netzilo.com/threats/untrusted-skill-install",
   "severity": "high",
   "summary": "This detects when a system or an AI agent installs a package, dependency, or 'skill' definition directly from a raw URL, GitHub link, or tarball archive rather than from an official package registry. That bypass skips the vetting and version integrity checks a registry normally provides, making it easier to slip in malicious code.",
   "atlas": [
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    }
   ],
   "owasp": [
    {
     "id": "LLM03",
     "name": "Supply Chain"
    },
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1195"
   ],
   "cves": [],
   "id": "8f715d20-5097-5a36-810f-5c8b9652a17b",
   "published": "2026-01-25",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/untrusted-skill-install.md"
  },
  {
   "slug": "urgency-manipulation",
   "title": "Urgency and Coercion Pressure in Agent Input",
   "url": "https://www.netzilo.com/threats/urgency-manipulation",
   "severity": "high",
   "summary": "This detects text fed to an AI agent that combines a manufactured sense of urgency with an explicit instruction to bypass a safety check. The idea is to rush the agent into acting before it can verify a request, rather than pretending to have authority.",
   "atlas": [
    {
     "id": "AML.T0051",
     "name": "LLM Prompt Injection"
    }
   ],
   "owasp": [
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    },
    {
     "id": "ASI06",
     "name": "Goal and Instruction Manipulation"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566",
    "attack.stealth",
    "attack.t1656"
   ],
   "cves": [],
   "id": "63cb1a2f-a7e0-5d3d-9b0e-795d70849fbc",
   "published": "2026-07-11",
   "modified": "2026-08-03",
   "markdown": "https://www.netzilo.com/threats/urgency-manipulation.md"
  },
  {
   "slug": "vulnerable-dependency",
   "title": "Known Vulnerable Package Installation",
   "url": "https://www.netzilo.com/threats/vulnerable-dependency",
   "severity": "high",
   "summary": "This rule flags when someone installs a software package via pip (Python) or npm (Node.js) that has a publicly known vulnerability. It relies on a fixed, built-in list of high-severity vulnerable packages rather than checking a live vulnerability database, so it only catches vulnerabilities that were known at the time the list was built.",
   "atlas": [
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    }
   ],
   "owasp": [
    {
     "id": "LLM03",
     "name": "Supply Chain"
    },
    {
     "id": "ASI08",
     "name": "Supply Chain Attacks on Agent Ecosystems"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1195",
    "attack.supply-chain"
   ],
   "cves": [],
   "id": "b1e2f3a4-b5c6-4d78-9012-e3f4a5b6c7d8",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/vulnerable-dependency.md"
  },
  {
   "slug": "webshell-patterns",
   "title": "Webshell Pattern in Agent-Written or Executed Code",
   "url": "https://www.netzilo.com/threats/webshell-patterns",
   "severity": "critical",
   "summary": "This rule flags webshell code appearing in files that an AI agent writes or in the content it passes through tool calls. A webshell is a small script an attacker plants on a server so they can run commands remotely through a web request, giving them a persistent backdoor.",
   "atlas": [
    {
     "id": "AML.T0053",
     "name": "AI Agent Tool Invocation"
    },
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.persistence",
    "attack.t1546",
    "attack.execution",
    "attack.t1059"
   ],
   "cves": [],
   "id": "88b9c0d1-e2f3-4a45-6789-b0c1d2e3f4a5",
   "published": "2026-06-03",
   "modified": "2026-06-03",
   "markdown": "https://www.netzilo.com/threats/webshell-patterns.md"
  },
  {
   "slug": "write-prompt-injection",
   "title": "Prompt Injection via File Write",
   "url": "https://www.netzilo.com/threats/write-prompt-injection",
   "severity": "high",
   "summary": "An AI agent can be tricked into writing a file whose content is not just data but a hidden instruction meant to manipulate whoever reads it next \u2014 another AI agent, or the same agent in a future session. This turns ordinary file output into a delivery mechanism for hijacking AI behaviour.",
   "atlas": [
    {
     "id": "AML.T0080",
     "name": "AI Agent Context Poisoning"
    },
    {
     "id": "AML.T0070",
     "name": "RAG Poisoning"
    }
   ],
   "owasp": [
    {
     "id": "ASI04",
     "name": "Memory and Context Poisoning"
    },
    {
     "id": "LLM01",
     "name": "Prompt Injection"
    }
   ],
   "attack": [
    "attack.initial-access",
    "attack.t1566"
   ],
   "cves": [],
   "id": "a0fc6a5a-7c68-5396-94d5-4096c8e5b013",
   "published": "2026-02-17",
   "modified": "2026-02-24",
   "markdown": "https://www.netzilo.com/threats/write-prompt-injection.md"
  },
  {
   "slug": "write-then-execute",
   "title": "Write-Then-Execute Script in Temporary Directory",
   "url": "https://www.netzilo.com/threats/write-then-execute",
   "severity": "high",
   "summary": "This rule flags a two-step pattern: something writes a script file into /tmp, /var/tmp, or /dev/shm, and then that same script gets executed. This is a common way to drop and run code that isn't meant to leave a trace in a normal application directory.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.stealth",
    "attack.t1027"
   ],
   "cves": [],
   "id": "2564f91e-155e-5d1c-afda-718922bb8a5f",
   "published": "2026-02-26",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/write-then-execute.md"
  },
  {
   "slug": "write-then-execute-periodic",
   "title": "Write-Then-Execute Script in Temporary Directory (EDR Graph)",
   "url": "https://www.netzilo.com/threats/write-then-execute-periodic",
   "severity": "high",
   "summary": "This detects a common malware pattern: a program drops a script file into a temporary directory like /tmp or /dev/shm and then executes it right away. Legitimate software rarely needs to write and run scripts from these locations, so this sequence is a strong sign of an attack in progress.",
   "atlas": [
    {
     "id": "AML.T0050",
     "name": "Command and Scripting Interpreter"
    }
   ],
   "owasp": [
    {
     "id": "ASI07",
     "name": "Unsafe Autonomous Code Execution"
    }
   ],
   "attack": [
    "attack.execution",
    "attack.t1059"
   ],
   "cves": [],
   "id": "2564f91e-155e-5d1c-afda-718922bb8a5f-p",
   "published": "2026-06-02",
   "modified": "2026-06-02",
   "markdown": "https://www.netzilo.com/threats/write-then-execute-periodic.md"
  },
  {
   "slug": "ssrf-url-parser-divergence",
   "title": "SSRF Filter Bypass via URL Parser Divergence",
   "url": "https://www.netzilo.com/threats/ssrf-url-parser-divergence",
   "severity": "high",
   "summary": "An attacker crafts a URL that looks safe to an application's security check but is actually sent to a different, forbidden address. This works because the code that validates the URL and the code that fetches it use different libraries with subtly different rules for parsing addresses.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.defense-evasion",
    "attack.command-and-control",
    "attack.t1071.001"
   ],
   "cves": [],
   "id": "7c1f4a92-3b58-4e6d-9a41-5f0c8d2be713",
   "published": "2025-06-18",
   "modified": "2025-06-18",
   "markdown": "https://www.netzilo.com/threats/ssrf-url-parser-divergence.md"
  },
  {
   "slug": "eddi-backup-import-zip-slip",
   "title": "Zip Slip Path Traversal in EDDI Backup Import",
   "url": "https://www.netzilo.com/threats/eddi-backup-import-zip-slip",
   "severity": "high",
   "summary": "E.D.D.I, an LLM middleware platform, has a backup restore feature that was vulnerable to a classic 'Zip Slip' flaw before version 5.5.0. An attacker could upload a specially crafted ZIP file whose internal file names escape the intended folder, letting the archive overwrite application files elsewhere on disk.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1190",
    "attack.persistence",
    "attack.t1574",
    "attack.execution"
   ],
   "cves": [],
   "id": "7d3f1c0a-9b42-4e57-8a16-2c5f0e9d4b31",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/eddi-backup-import-zip-slip.md"
  },
  {
   "slug": "vllm-guided-json-invalid-schema-dos",
   "title": "vLLM Guided Decoding Invalid JSON Schema DoS",
   "url": "https://www.netzilo.com/threats/vllm-guided-json-invalid-schema-dos",
   "severity": "high",
   "summary": "vLLM lets clients request 'guided decoding', where a JSON Schema constrains the model's output format. If that schema contains an invalid 'type' field, the underlying grammar compiler throws an error that isn't caught, and it kills the entire server process instead of just failing the one request.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.impact",
    "attack.t1499",
    "attack.t1499.004"
   ],
   "cves": [],
   "id": "7b1e4c92-6a3f-4d58-9c41-0e2a7f5b8d63",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/vllm-guided-json-invalid-schema-dos.md"
  },
  {
   "slug": "npm-oauth-adapter-credential-egress",
   "title": "Supply Chain npm Install Context Credential Egress (@edge-sky/dsh-oauth-adapter)",
   "url": "https://www.netzilo.com/threats/npm-oauth-adapter-credential-egress",
   "severity": "high",
   "summary": "This rule flags a specific attack pattern seen with the package @edge-sky/dsh-oauth-adapter: during package installation, a script reads OAuth or cloud credential files it has no legitimate reason to touch, then sends an outbound network request. It also flags any session where the package name itself shows up in commands or URLs.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1195.001",
    "attack.credential-access",
    "attack.t1552.001",
    "attack.exfiltration",
    "attack.t1041"
   ],
   "cves": [],
   "id": "7f3c1d2e-8b64-4a19-9c07-5e2ad84b1f36",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/npm-oauth-adapter-credential-egress.md"
  },
  {
   "slug": "cykani-stealth-browser-sdk",
   "title": "Stealth Browser SDK Cykani Install or Invocation",
   "url": "https://www.netzilo.com/threats/cykani-stealth-browser-sdk",
   "severity": "medium",
   "summary": "This detects when an AI agent (or a process it spawned) pulls in and uses 'cykani', a PyPI package designed to automate a browser while evading detection as automation. The rule flags the presence of this specific tool, not any proven malicious action.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1195.002",
    "attack.execution",
    "attack.t1059.006",
    "attack.defense-evasion"
   ],
   "cves": [],
   "id": "7f3c1b2e-9d64-4a17-b0e5-2c8a41d6f9b3",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/cykani-stealth-browser-sdk.md"
  },
  {
   "slug": "agentapi-dns-rebinding",
   "title": "AgentAPI DNS Rebinding Localhost Access",
   "url": "https://www.netzilo.com/threats/agentapi-dns-rebinding",
   "severity": "high",
   "summary": "A malicious web page can trick a browser into treating a locally-running AgentAPI service as if it belonged to the attacker's website, then use that trust to read out private message history, secret keys, and file contents. This works against older AgentAPI versions (0.3.3 and below) that run over plain HTTP without protections against this technique.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1189",
    "attack.collection",
    "attack.t1005",
    "attack.exfiltration",
    "attack.t1567"
   ],
   "cves": [],
   "id": "7b3f1c94-2a6e-4d51-9c0f-8e42d5a1b6f3",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/agentapi-dns-rebinding.md"
  },
  {
   "slug": "rungpt-eval-command-injection",
   "title": "Python eval() Sink Exploitation - RunGptLLM Command Injection",
   "url": "https://www.netzilo.com/threats/rungpt-eval-command-injection",
   "severity": "high",
   "summary": "Some AI agent frameworks pass text returned by a language model straight into Python's eval() function. If an attacker controls that model output, they can smuggle in code disguised as a normal expression and get it to run with the same privileges as the agent.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059.006"
   ],
   "cves": [],
   "id": "b3f7a91c-4d2e-4a06-9f18-6c5d0e83a1b7",
   "published": "2026-03-01",
   "modified": "2026-03-01",
   "markdown": "https://www.netzilo.com/threats/rungpt-eval-command-injection.md"
  },
  {
   "slug": "fastgpt-sandbox-escape-syscalls",
   "title": "Sandbox Escape - Permissive Syscall Abuse in Agent Code Execution (FastGPT Sandbox)",
   "url": "https://www.netzilo.com/threats/fastgpt-sandbox-escape-syscalls",
   "severity": "high",
   "summary": "An attacker who can run code inside a FastGPT sandbox (versions before 4.9.11) can use that access to break out of the container and touch the underlying host. The sandbox lets scripts call dangerous low-level system functions it should have blocked.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.privilege-escalation",
    "attack.defense-evasion",
    "attack.t1611",
    "attack.t1068",
    "attack.t1059.006"
   ],
   "cves": [],
   "id": "7b3c9d24-5f81-4a6e-9d0b-2c14e8f37a56",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/fastgpt-sandbox-escape-syscalls.md"
  },
  {
   "slug": "langchain-numexpr-rce-exec",
   "title": "LangChain numexpr Evaluate RCE - Interpreter Shell Escape",
   "url": "https://www.netzilo.com/threats/langchain-numexpr-rce-exec",
   "severity": "high",
   "summary": "LangChain's math tools (LLMMathChain, PALChain) can be tricked into passing attacker-controlled text into numexpr's evaluate() function, which can run arbitrary code. This rule catches the moment that code actually spawns an OS command with signs of a real attack, not just the underlying bug.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.t1059.004",
    "attack.t1059.006",
    "attack.t1203"
   ],
   "cves": [
    "CVE-2023-36258"
   ],
   "id": "6f2b9c14-8d3a-4a17-9f5e-2c7b41ad0e93",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/langchain-numexpr-rce-exec.md"
  },
  {
   "slug": "langchain-palchain-exec-rce",
   "title": "LangChain PALChain Python Exec RCE (CVE-2023-36258)",
   "url": "https://www.netzilo.com/threats/langchain-palchain-exec-rce",
   "severity": "high",
   "summary": "LangChain versions up to 0.0.64 include a feature called PALChain that generates Python code from a prompt and then runs it directly with no safety checks. An attacker who controls or influences the prompt can make PALChain generate code that calls out to the operating system, giving them command execution on the host running the application.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.t1059.006",
    "attack.t1203"
   ],
   "cves": [
    "CVE-2023-36258",
    "CVE-2023-39631",
    "CVE-2023-44467"
   ],
   "id": "7c3f9a2e-5b41-4d68-9e0a-2f6b8c1d34a5",
   "published": "2025-06-12",
   "modified": "2025-06-12",
   "markdown": "https://www.netzilo.com/threats/langchain-palchain-exec-rce.md"
  },
  {
   "slug": "llm-as-chatbot-modelsbyom-rce-descendant-exec",
   "title": "LLM-As-Chatbot modelsbyom Component Descendant Code Execution",
   "url": "https://www.netzilo.com/threats/llm-as-chatbot-modelsbyom-rce-descendant-exec",
   "severity": "high",
   "summary": "This detects the aftermath of a code execution flaw in the LLM-As-Chatbot application's modelsbyom.py component. It watches for a suspicious shell or downloader process being spawned from that vulnerable component, which is the pattern left behind when someone exploits the flaw to run their own commands.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.t1190",
    "attack.initial-access"
   ],
   "cves": [
    "CVE-2024-55241"
   ],
   "id": "4f2b8d7a-1c63-4e29-9a5f-0d84b1c7e3f6",
   "published": "2026-03-14",
   "modified": "2026-03-14",
   "markdown": "https://www.netzilo.com/threats/llm-as-chatbot-modelsbyom-rce-descendant-exec.md"
  },
  {
   "slug": "vllm-zeromq-pickle-rce",
   "title": "vLLM ZeroMQ Pickle Deserialization RCE - Payload Spawn Under Inference Server",
   "url": "https://www.netzilo.com/threats/vllm-zeromq-pickle-rce",
   "severity": "high",
   "summary": "A known flaw in vLLM's ZeroMQ-based KV-cache transfer feature (versions 0.6.5\u20130.8.4) lets anyone who can reach the exposed network socket send a malicious data payload that the server unpacks unsafely, causing it to run arbitrary code. This rule watches for the moment that code execution actually happens, not the network exploit itself.",
   "atlas": [
    {
     "id": "AML.T0010",
     "name": "AI Supply Chain Compromise"
    }
   ],
   "owasp": [],
   "attack": [
    "attack.initial_access",
    "attack.t1190",
    "attack.execution",
    "attack.t1059",
    "attack.t1203"
   ],
   "cves": [
    "CVE-2025-32444"
   ],
   "id": "3f7a2c1d-9b64-4e5a-8c2f-1d6b0a94e7c3",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/vllm-zeromq-pickle-rce.md"
  },
  {
   "slug": "vllm-v0-zeromq-pickle-rce",
   "title": "vLLM V0 Multi-Node ZeroMQ Pickle Deserialization RCE Surface",
   "url": "https://www.netzilo.com/threats/vllm-v0-zeromq-pickle-rce",
   "severity": "high",
   "summary": "vLLM's older V0 engine, when run across multiple machines, sends data between nodes using Python's pickle format over ZeroMQ sockets. Pickle data can execute arbitrary code when loaded, so any host that can reach the ZeroMQ port of a V0 multi-node deployment can potentially run code on it. This detection flags both the risky configuration and command lines that actively use the pickle/ZeroMQ primitives together.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059.006",
    "attack.lateral-movement",
    "attack.t1210"
   ],
   "cves": [
    "CVE-2025-30165"
   ],
   "id": "7b1e4c8a-2d93-4f61-9a0e-5c8d3f27b4e1",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/vllm-v0-zeromq-pickle-rce.md"
  },
  {
   "slug": "vllm-pyncclpipe-pickle-rce",
   "title": "vLLM PyNcclPipe Unsafe Pickle Deserialization RCE",
   "url": "https://www.netzilo.com/threats/vllm-pyncclpipe-pickle-rce",
   "severity": "high",
   "summary": "vLLM's disaggregated-prefill feature moves data between servers using Python's pickle format, which can execute arbitrary code when loading untrusted input. An attacker who can reach this channel can trigger remote code execution on the vLLM server, and a related networking bug means the channel is often reachable even when configured to be private.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1190",
    "attack.execution",
    "attack.t1059.006"
   ],
   "cves": [],
   "id": "3f7a1c92-5e84-4d6b-9a1f-0c2be7d5a483",
   "published": "2026-01-14",
   "modified": "2026-01-14",
   "markdown": "https://www.netzilo.com/threats/vllm-pyncclpipe-pickle-rce.md"
  },
  {
   "slug": "vllm-audio-oversized-upload-dos",
   "title": "vLLM Audio Route Oversized Upload Memory Exhaustion",
   "url": "https://www.netzilo.com/threats/vllm-audio-oversized-upload-dos",
   "severity": "medium",
   "summary": "vLLM's speech-to-text endpoints read the whole uploaded file into memory before checking if it's too large. An attacker who sends very large or repeated large audio uploads can exhaust server memory and crash the inference process, a denial-of-service that costs nothing but bandwidth.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.impact",
    "attack.t1499",
    "attack.t1499.003"
   ],
   "cves": [],
   "id": "b7c4f0d2-3a19-4e6b-9c58-6f2d1a84e370",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/vllm-audio-oversized-upload-dos.md"
  },
  {
   "slug": "vllm-trust-remote-code-override",
   "title": "vLLM Hardcoded trust_remote_code Override",
   "url": "https://www.netzilo.com/threats/vllm-trust-remote-code-override",
   "severity": "high",
   "summary": "vLLM lets operators disable automatic execution of code bundled inside a model repository by setting trust_remote_code=False. For a handful of model families (Nemotron-VL, Kimi-K2.5), vLLM's own loading code ignores that setting and runs the model's Python code anyway. This turns a security control into a false sense of safety.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059.006",
    "attack.defense-evasion",
    "attack.t1562.001",
    "attack.t1195.001"
   ],
   "cves": [],
   "id": "6f2c7b41-9d3e-4a58-b0c7-2e1f84d5a9c3",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/vllm-trust-remote-code-override.md"
  },
  {
   "slug": "hydra-instantiate-target-rce",
   "title": "Hydra instantiate() Target Hijack to Process Execution",
   "url": "https://www.netzilo.com/threats/hydra-instantiate-target-rce",
   "severity": "high",
   "summary": "Hydra, a Python configuration framework, lets a config value called '_target_' name a function or class to instantiate. If an attacker can influence that config - through a CLI override, a local YAML file, or a downloaded artifact - they can point it at os.system or a similar call and get code execution when the job runs.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.t1059.004",
    "attack.t1059.006"
   ],
   "cves": [],
   "id": "3f9c7b41-0a2e-4d16-9b8c-7e5a1c26d4f0",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/hydra-instantiate-target-rce.md"
  },
  {
   "slug": "roo-npm-postinstall-rce",
   "title": "Auto-Approved Package Install Executes Postinstall Payload",
   "url": "https://www.netzilo.com/threats/roo-npm-postinstall-rce",
   "severity": "high",
   "summary": "Roo Code, an AI coding agent, can auto-approve package installs without human review. Attackers exploit this by pointing it at a malicious repository whose package.json contains a postinstall script that runs automatically during npm install, giving the attacker code execution on the developer's machine.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059.004",
    "attack.initial-access",
    "attack.t1195.001",
    "attack.persistence",
    "attack.t1546"
   ],
   "cves": [],
   "id": "7f3c1d92-4a68-4f1e-9b0c-2d5e8a71c604",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/roo-npm-postinstall-rce.md"
  },
  {
   "slug": "aipager-telegram-remote-control",
   "title": "Telegram Remote Control Daemon Targeting Claude Code CLI (aipager)",
   "url": "https://www.netzilo.com/threats/aipager-telegram-remote-control",
   "severity": "high",
   "summary": "A tool called aipager connects a Telegram bot to a running Claude Code CLI session, letting someone on Telegram send commands to that session remotely. This detection catches it being installed, started, or built by hand.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.command-and-control",
    "attack.t1102.002",
    "attack.t1219",
    "attack.execution",
    "attack.t1059.004",
    "attack.persistence"
   ],
   "cves": [],
   "id": "3f2c9a41-7d68-4e5b-9c1a-b8e6d02f4a37",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/aipager-telegram-remote-control.md"
  },
  {
   "slug": "1panel-cert-bypass-rce",
   "title": "1Panel Core-Agent TLS Verification Bypass to Privileged Command API",
   "url": "https://www.netzilo.com/threats/1panel-cert-bypass-rce",
   "severity": "high",
   "summary": "This detects a two-part pattern seen when someone exploits a certificate verification weakness in 1Panel (versions 2.0.5 and earlier) between its Core and Agent components. It fires only when a client that has explicitly turned off TLS certificate checking also sends a command to one of 1Panel's high-privilege endpoints carrying an actual attack payload like a reverse shell or download-and-execute string.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1190",
    "attack.credential-access",
    "attack.t1557",
    "attack.execution",
    "attack.t1059.004"
   ],
   "cves": [],
   "id": "7c3f9a41-5e2b-4d18-9f6a-2b8c1d40e7a3",
   "published": "2026-03-14",
   "modified": "2026-03-14",
   "markdown": "https://www.netzilo.com/threats/1panel-cert-bypass-rce.md"
  },
  {
   "slug": "ssrf-backslash-at-url-bypass",
   "title": "SSRF Backslash-At URL Authority Confusion",
   "url": "https://www.netzilo.com/threats/ssrf-backslash-at-url-bypass",
   "severity": "high",
   "summary": "A flaw in vLLM versions before 0.17.0 lets attackers sneak a URL past the server's allow-list check by putting a backslash right before the '@' symbol. The validator and the actual HTTP client disagree about where the hostname starts, so a request that looks safe on paper actually gets sent to an internal address.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.discovery",
    "attack.t1046",
    "attack.credential-access",
    "attack.t1552.005"
   ],
   "cves": [],
   "id": "7c1f4a2e-9b83-4d16-a5f0-2e6c8d31b4af",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/ssrf-backslash-at-url-bypass.md"
  },
  {
   "slug": "vllm-pickle-weights-rce",
   "title": "vLLM Malicious Model Weights Deserialization RCE",
   "url": "https://www.netzilo.com/threats/vllm-pickle-weights-rce",
   "severity": "high",
   "summary": "An attacker embeds a hidden pickle payload inside a model checkpoint file hosted on a model hub. When a vLLM inference server loads that checkpoint, the payload runs automatically inside the server process, giving the attacker code execution on the host.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059.006",
    "attack.initial-access",
    "attack.t1195.001"
   ],
   "cves": [],
   "id": "7c1e9a34-5f2b-4d68-9a01-3e6b8f2c4d17",
   "published": "2026-06-01",
   "modified": "2026-06-01",
   "markdown": "https://www.netzilo.com/threats/vllm-pickle-weights-rce.md"
  },
  {
   "slug": "vllm-openai-serving-resource-teardown-dos",
   "title": "vLLM OpenAI-Compatible Serving Path Resource Teardown DoS Payload",
   "url": "https://www.netzilo.com/threats/vllm-openai-serving-resource-teardown-dos",
   "severity": "high",
   "summary": "This rule flags single API requests to a vLLM model-serving endpoint that contain parameter values no normal client would ever send, such as negative or absurd token limits. These malformed requests can trigger a resource cleanup bug in vLLM 0.19.0's OpenAI-compatible server, causing the inference service to fail.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.impact",
    "attack.t1499",
    "attack.t1499.004"
   ],
   "cves": [],
   "id": "7b3c9f2e-5a41-4d86-9c07-2f8e6b1a4d53",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/vllm-openai-serving-resource-teardown-dos.md"
  },
  {
   "slug": "gha-pr-metadata-injection-rce",
   "title": "GitHub Actions PR Metadata Script Injection RCE",
   "url": "https://www.netzilo.com/threats/gha-pr-metadata-injection-rce",
   "severity": "high",
   "summary": "Many CI workflows insert pull-request data \u2014 like the PR title, description, branch name, or a comment \u2014 directly into a shell command. If that text isn't sanitized, an attacker can put shell code inside a PR field and get it executed on the runner with the workflow's permissions. This rule watches for the runner actually spawning a process built from that tainted input.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.t1059.004",
    "attack.credential_access",
    "attack.t1552",
    "attack.t1552.001",
    "attack.persistence",
    "attack.t1574.006",
    "attack.initial_access",
    "attack.t1195.002"
   ],
   "cves": [],
   "id": "7f2c9a41-3d5e-4b18-9c6a-0e83b7d41af2",
   "published": "2026-03-18",
   "modified": "2026-03-18",
   "markdown": "https://www.netzilo.com/threats/gha-pr-metadata-injection-rce.md"
  },
  {
   "slug": "dependency-confusion-unsafe-index-strategy",
   "title": "Supply Chain Unsafe Index Resolution During Package Install",
   "url": "https://www.netzilo.com/threats/dependency-confusion-unsafe-index-strategy",
   "severity": "high",
   "summary": "This detects the exact command-line moment when a Python package installer is run with a 'best match across all indexes' setting, or when it installs a specific known-malicious version of the flashinfer-jit-cache package. That setting lets an installer silently prefer a public PyPI package over a private vendor package with the same name and a higher version number, which is how the vLLM/flashinfer-jit-cache dependency confusion attack gets its malicious code pulled in.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.execution",
    "attack.t1195.002"
   ],
   "cves": [],
   "id": "7c1f4a2e-9d63-4b58-8f0a-2ec5d1b73a94",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/dependency-confusion-unsafe-index-strategy.md"
  },
  {
   "slug": "linkedin-sdr-outreach-fanout",
   "title": "LinkedIn SDR Agent Automated Outreach Fan-Out",
   "url": "https://www.netzilo.com/threats/linkedin-sdr-outreach-fanout",
   "severity": "medium",
   "summary": "This rule flags when an automated LinkedIn 'SDR' agent (a tool that finds prospects and sends connection requests or messages on your behalf) builds a list of targets and then blasts out a large batch of invites or messages in a short time, all from one automated process rather than a person using the browser. It doesn't judge whether the messages are legitimate or malicious \u2014 it just flags the unattended, high-volume pattern.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1566.003",
    "attack.resource-development",
    "attack.t1585.001",
    "attack.collection"
   ],
   "cves": [],
   "id": "7b3c1e42-9d0a-4f6b-8c25-1ae5f70d3b98",
   "published": "2026-03-05",
   "modified": "2026-03-05",
   "markdown": "https://www.netzilo.com/threats/linkedin-sdr-outreach-fanout.md"
  },
  {
   "slug": "haystack-jinja2-ssti-rce",
   "title": "SSTI Jinja2 Template Injection RCE (Haystack Pipeline)",
   "url": "https://www.netzilo.com/threats/haystack-jinja2-ssti-rce",
   "severity": "high",
   "summary": "This detects command-line evidence that someone exploited a server-side template injection flaw in deepset Haystack (versions before 2.3.1) to run arbitrary code. It looks for the tell-tale combination of Jinja2 template syntax and Python's sandbox-escape trick showing up together in a spawned process.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059.006",
    "attack.t1190"
   ],
   "cves": [],
   "id": "7c3f9a2e-5b41-4d6c-9e08-2a1f6b84c37d",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/haystack-jinja2-ssti-rce.md"
  },
  {
   "slug": "pypi-sandbox-cli-sdk-install",
   "title": "Supply Chain - PyPI Install of sandbox-cli-sdk",
   "url": "https://www.netzilo.com/threats/pypi-sandbox-cli-sdk-install",
   "severity": "medium",
   "summary": "This detects when an AI agent, or a process it started, runs a Python package manager to install or execute the package sandbox-cli-sdk. That package is a legitimate developer tool for running commands inside isolated containers, but it can also give an agent a quiet way to run code outside normal host monitoring.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1195.002",
    "attack.execution",
    "attack.t1059.006"
   ],
   "cves": [],
   "id": "4f3c9b2e-7d81-4a56-9c0f-2b6e5d18a7c3",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/pypi-sandbox-cli-sdk-install.md"
  },
  {
   "slug": "anythingllm-export-traversal-dos",
   "title": "AnythingLLM Data-Export Path Traversal DoS Request",
   "url": "https://www.netzilo.com/threats/anythingllm-export-traversal-dos",
   "severity": "high",
   "summary": "AnythingLLM's file-export feature can be crashed with a single unauthenticated web request. By sending a crafted filename containing path traversal characters, an attacker can make the server delete files outside the intended folder and crash, taking the AI service offline.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.impact",
    "attack.t1499",
    "attack.t1499.004",
    "attack.initial-access",
    "attack.t1190"
   ],
   "cves": [],
   "id": "7b3c1f8e-2d54-4a61-9c0f-5e8a4d3b6127",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/anythingllm-export-traversal-dos.md"
  },
  {
   "slug": "agent-command-allowlist-bypass",
   "title": "Agent Command Allowlist Bypass via Shell Chaining",
   "url": "https://www.netzilo.com/threats/agent-command-allowlist-bypass",
   "severity": "high",
   "summary": "Some autonomous coding agents only check the first word of a command before deciding whether to run it without asking the user. An attacker (or a compromised prompt) can put an approved-looking command first, then chain on a completely different, unapproved program using shell operators like && or a pipe, and the agent will auto-execute the whole thing.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059",
    "attack.defense-evasion",
    "attack.t1562.001"
   ],
   "cves": [],
   "id": "7b1c94e2-3f5a-4d8e-9c2b-5a6f0d31e847",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/agent-command-allowlist-bypass.md"
  },
  {
   "slug": "vllm-unsafe-checkpoint-deserialization",
   "title": "vLLM Malicious Model Checkpoint Deserialization",
   "url": "https://www.netzilo.com/threats/vllm-unsafe-checkpoint-deserialization",
   "severity": "high",
   "summary": "vLLM and similar tools load model weights using Python's pickle format, which can run arbitrary code during loading. An attacker who can get a poisoned checkpoint file loaded gets code execution on the machine that loads it.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.execution",
    "attack.t1059.006",
    "attack.t1195.002"
   ],
   "cves": [],
   "id": "7c1f4b2e-9a63-4d81-b0c5-3f6a2d5e8471",
   "published": "2026-03-14",
   "modified": "2026-03-14",
   "markdown": "https://www.netzilo.com/threats/vllm-unsafe-checkpoint-deserialization.md"
  },
  {
   "slug": "open-webui-blind-ssrf",
   "title": "SSRF Open WebUI URL Loader Internal Target",
   "url": "https://www.netzilo.com/threats/open-webui-blind-ssrf",
   "severity": "high",
   "summary": "Open WebUI lets users hand it a URL to fetch content \u2014 web pages, YouTube transcripts, documents, plugins. An attacker with a valid account can abuse this to make the server fetch internal-only addresses instead, probing or reaching systems that should not be reachable from outside.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial_access",
    "attack.t1190",
    "attack.discovery",
    "attack.t1046"
   ],
   "cves": [],
   "id": "7b3f1c42-9d18-4a76-b0e5-2c94f8d61a3e",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/open-webui-blind-ssrf.md"
  },
  {
   "slug": "mcp-streamable-session-churn",
   "title": "MCP Streamable-HTTP Session Churn (Uncaught ClosedResourceError DoS)",
   "url": "https://www.netzilo.com/threats/mcp-streamable-session-churn",
   "severity": "medium",
   "summary": "This detects a pattern where a client keeps reconnecting to an MCP streamable-HTTP server, but each new connection carries almost no actual traffic before dying. That pattern matches how CVE-2025-53365 is exploited: a crafted request crashes the server's session handler, forcing constant restarts.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.impact",
    "attack.t1499",
    "attack.t1499.004"
   ],
   "cves": [
    "CVE-2025-53365"
   ],
   "id": "7f3c9d21-4b8e-4a6f-9c1d-5e2a8b4f6031",
   "published": "2026-03-14",
   "modified": "2026-03-14",
   "markdown": "https://www.netzilo.com/threats/mcp-streamable-session-churn.md"
  },
  {
   "slug": "ssrf-redirect-bypass-chain",
   "title": "SSRF Redirect Bypass in Agent Scraping Fetch",
   "url": "https://www.netzilo.com/threats/ssrf-redirect-bypass-chain",
   "severity": "high",
   "summary": "An AI agent that fetches web pages can be tricked into visiting internal, non-public addresses. This happens when an attacker's public URL responds with an HTTP redirect pointing at an internal host, and the agent follows it without re-checking whether that new destination is allowed.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.discovery",
    "attack.t1046"
   ],
   "cves": [],
   "id": "3f1c9a6e-8d24-4b71-9c53-2a7e5b0d61f4",
   "published": "2026-03-05",
   "modified": "2026-03-05",
   "markdown": "https://www.netzilo.com/threats/ssrf-redirect-bypass-chain.md"
  },
  {
   "slug": "langflow-superuser-cli-escalation",
   "title": "Langflow Privilege Escalation via Superuser CLI Invocation",
   "url": "https://www.netzilo.com/threats/langflow-superuser-cli-escalation",
   "severity": "high",
   "summary": "Langflow is an AI workflow builder with a normal sign-up page that only ever creates regular, non-admin users. It also ships a hidden command-line option, 'langflow superuser', that writes a full administrator account straight into the database, skipping that restriction entirely.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.privilege_escalation",
    "attack.persistence",
    "attack.t1136.001",
    "attack.t1078.003"
   ],
   "cves": [],
   "id": "3f2b8c1e-7d4a-4e6b-9c05-8a1d2f6b4e93",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/langflow-superuser-cli-escalation.md"
  },
  {
   "slug": "langsmith-hub-untrusted-prompt-pull",
   "title": "LangSmith Hub Third-Party Prompt Manifest Pull With Model Deserialization",
   "url": "https://www.netzilo.com/threats/langsmith-hub-untrusted-prompt-pull",
   "severity": "medium",
   "summary": "LangChain/LangSmith Hub lets you fetch a saved prompt by owner and name. If the fetch also asks for the 'model' part of that prompt, the response can include settings that build an LLM client inside your app \u2014 pointing it at whatever server and API key the prompt author chose. Pulling this from anyone outside your own organization hands them a way to redirect or spy on your app's traffic.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1195.001",
    "attack.credential-access",
    "attack.t1552"
   ],
   "cves": [],
   "id": "5b8c2e14-9a37-4d61-b0f2-6e8a13c47d95",
   "published": "2026-06-11",
   "modified": "2026-06-11",
   "markdown": "https://www.netzilo.com/threats/langsmith-hub-untrusted-prompt-pull.md"
  },
  {
   "slug": "eddi-backup-export-path-traversal",
   "title": "EDDI Backup Export Path Traversal Attempt",
   "url": "https://www.netzilo.com/threats/eddi-backup-export-path-traversal",
   "severity": "medium",
   "summary": "Attackers can trick the E.D.D.I chatbot platform's backup export feature into returning files from outside its intended folder, including configuration files and secrets stored in the container. This affects E.D.D.I versions before 5.4 and is exploited through a parameter called botFilename.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1190",
    "attack.discovery",
    "attack.t1083"
   ],
   "cves": [],
   "id": "7b3c9e42-5d18-4a6f-9c21-8ef04b7d31a5",
   "published": "2026-03-01",
   "modified": "2026-03-01",
   "markdown": "https://www.netzilo.com/threats/eddi-backup-export-path-traversal.md"
  },
  {
   "slug": "vllm-revision-pinning-bypass",
   "title": "Model Supply Chain - vLLM Incomplete Revision Pinning at Launch",
   "url": "https://www.netzilo.com/threats/vllm-revision-pinning-bypass",
   "severity": "medium",
   "summary": "vLLM lets operators pin a model to a specific commit so it can't silently change, but that pin doesn't cover everything. Remote code, GGUF weight files, and companion tokenizer repos can still be pulled from the repository's default branch even when the operator thinks the whole model is locked down.",
   "atlas": [
    {
     "id": "AML.T0011",
     "name": "User Execution"
    }
   ],
   "owasp": [],
   "attack": [
    "attack.initial_access",
    "attack.t1195.002"
   ],
   "cves": [],
   "id": "6f1c9a24-7d8e-4b3a-9c05-2ae4f7b18d31",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/vllm-revision-pinning-bypass.md"
  },
  {
   "slug": "titah-code-npm-delegation",
   "title": "Supply Chain Titah-Code NPM Agent Delegation CLI",
   "url": "https://www.netzilo.com/threats/titah-code-npm-delegation",
   "severity": "medium",
   "summary": "Titah-code is an npm package that delegates coding tasks to third-party AI editors like Claude and opencode, which means it also hands over your prompts, repository contents, and API credentials to those external tools. This rule does not claim the package is malicious; it simply logs every time it is installed or run so someone can review whether that data path is acceptable.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.initial-access",
    "attack.t1195.002",
    "attack.execution",
    "attack.t1059"
   ],
   "cves": [],
   "id": "4e1c8f2d-9a6b-4c73-b1f0-2d7a5e46c918",
   "published": "2026-03-01",
   "modified": "2026-03-01",
   "markdown": "https://www.netzilo.com/threats/titah-code-npm-delegation.md"
  },
  {
   "slug": "ssrf-image-url-token-count",
   "title": "SSRF Image URL Fetch to Internal or Cloud Metadata Endpoint",
   "url": "https://www.netzilo.com/threats/ssrf-image-url-token-count",
   "severity": "high",
   "summary": "A bug in LangChain's ChatOpenAI token counter causes it to fetch attacker-supplied image URLs directly from the agent's server before ever sending the message to the AI model. If that URL points at an internal address, the agent host makes the request for you, giving an attacker a foothold to probe internal networks or cloud metadata services.",
   "atlas": [],
   "owasp": [],
   "attack": [
    "attack.credential-access",
    "attack.t1552.005",
    "attack.discovery",
    "attack.t1046"
   ],
   "cves": [],
   "id": "b7f3c1a4-6d2e-4a58-9c31-5e0f2a7d84b6",
   "published": "2026-06-12",
   "modified": "2026-06-12",
   "markdown": "https://www.netzilo.com/threats/ssrf-image-url-token-count.md"
  }
 ]
}