Agent Command Execution - Indirect Prompt Injection Payload (AWS Kiro)

How the attack works

An attacker plants instructions inside content the agent is likely to read, such as a file, dependency, or web page. When the agent processes that content, the hidden instructions hijack its behavior and get it to spawn a system command. The resulting command line typically downloads and runs remote code, decodes and executes an encoded payload, opens an interactive shell over a network socket, or drops a file into a temp directory and executes it. The detection looks for that final command line, since the injection itself happens inside data the agent reads and isn't directly visible.

Netzilo detection

Why it matters

A successful attack gives the intruder arbitrary code execution on the machine running the agent, which can lead to credential theft, source code exposure, or further compromise of the developer's environment.

What you can do

• →Restrict what external content your AI coding agent is allowed to fetch or read unattended, especially untrusted web pages, issues, or third-party dependencies.
• →Run coding agents in a sandboxed or least-privilege environment so a hijacked command cannot reach production credentials or sensitive systems.
• →Review agent-spawned command lines for fetch-and-execute, decode-and-execute, or reverse-shell patterns, and treat unexpected ones as suspicious even if they resemble developer install scripts.
• →Keep a human-in-the-loop approval step for any command an agent wants to execute that involves network downloads, base64-decoded payloads, or inline interpreter one-liners.

Known benign look-alikes

• Developer install one-liners the user explicitly asked the agent to run (a version-manager or toolchain bootstrapper piped from a fetch into sh). This is the single most common benign match and is the reason the rule reports rather than blocks.
• CI/build bootstrap that downloads an installer into /tmp, chmod +x it, and executes it.
• Legitimate inline interpreter one-liners used by build tooling or by the agent itself for scripted refactors (e.g. python3 -c with subprocess, node -e with child_process).
• Container/devcontainer entrypoints that write a heredoc helper script into /tmp and run it.
• Intentional red-team or security-training exercises that execute reverse-shell test payloads.
• Code-search, SAST or secret-scanner invocations whose arguments embed an install snippet (suppressed by filter_code_search when the scanner is the leading token).
• Documentation viewers printing an install snippet (suppressed by filter_doc_reader).

References

• https://attack.mitre.org/techniques/T1059/
• https://attack.mitre.org/techniques/T1105/
• https://attack.mitre.org/techniques/T1027/
• https://owasp.org/www-project-top-10-for-large-language-model-applications/

Related threats