How the attack works
An AI agent's tool call runs a command that combines a lateral-movement action (scp, rsync, ssh-copy-id, sshpass, a network scan, or persistence setup) with a real remote target — a hostname or IP address, optionally with a username. Examples include archiving ~/.ssh, ~/.aws or ~/.kube and piping it to ssh/nc/curl, appending a key to a remote authorized_keys file, chaining an nmap/masscan sweep straight into an ssh/scp session, starting an agent runtime on a remote host over ssh, installing a cron/systemd/launchctl job remotely, reusing a password via sshpass, or opening a dynamic/reverse SSH tunnel. The rule only looks at the one command as written; it does not track what happened before or after.
Why it matters
An attacker who reaches one AI-agent host can use it as a jumping-off point to steal SSH keys or cloud credentials, plant persistent access on other machines, or pivot deeper into the network — turning a single compromised agent into a multi-host breach.
What you can do
- Restrict AI agents' shell access so they cannot invoke scp, rsync, ssh, sshpass, or network scanners without explicit approval.
- Keep credential directories (~/.ssh, ~/.aws, ~/.kube) out of reach of agent processes or store credentials in a vault instead of flat files.
- Review any agent-run command that scans a network and then connects outward, or that touches remote authorized_keys, cron, systemd, or launchctl entries.
- Maintain a list of approved provisioning/deployment jobs that legitimately use ssh-copy-id or rsync so real alerts aren't buried in routine ops noise.
Known benign look-alikes
- Platform/SRE agents running an approved provisioning job that uses ssh-copy-id the first time a new build host is enrolled.
- Deployment agents that rsync application configuration to a managed host and then run "systemctl enable" over ssh as part of a release.
- Authorized internal vulnerability-scanning workflows that pipe an nmap sweep into an ssh reachability check.
- Developer agents opening an ssh dynamic/reverse tunnel to reach a bastion-only service during debugging.
- An agent authoring a runbook, README or shell tutorial that contains example scp/ssh commands (mitigated by filter_docwrite and filter_placeholder).
- Help, version or man-page invocations of ssh/scp/rsync/nmap (mitigated by filter_help) and rsync dry runs (mitigated by filter_dryrun).