How the attack works
An attacker plants malicious instructions somewhere the AI agent will read them, such as a document, webpage, or tool output the agent processes as part of its task. The injected instructions direct the agent to use curl or wget to download a script from an attacker-controlled URL. The agent, following the injected instructions, pipes that downloaded content directly into a shell (for example curl url | sh), executing it without ever writing it to disk for review. Because the script runs immediately, whatever code the attacker placed at that URL executes with the agent's privileges.
Why it matters
An organization can lose control of any system the agent has access to, since the attacker's script runs with the agent's permissions and can install backdoors, exfiltrate data, or pivot further.
What you can do
- Restrict the AI agent's ability to execute shell commands, especially pipe-to-shell patterns like curl/wget piped to sh or bash.
- Require scripts to be downloaded, inspected, and reviewed before execution rather than executed inline.
- Maintain an allowlist of trusted domains the agent can fetch installers or scripts from, and block execution from all others.
- Treat any content the agent ingests (web pages, documents, tool outputs) as untrusted input and sandbox the agent's execution environment accordingly.
Known benign look-alikes
- Legitimate installer scripts from trusted vendors that use pipe-to-shell patterns
- OpenClaw automation workflows that bootstrap environments from internal artifact stores