OpenClaw Stealth Agent Session Spawn

How the attack works

An operator (or script) launches an AI coding-agent binary with a flag that puts it into unattended or auto-approve mode, bypassing normal human confirmation of its actions. In the same command line, they also detach the process from the controlling terminal or redirect/suppress its stdout, shell history, or telemetry. The result is a background agent session that keeps running and making changes but produces no visible trace for the person who spawned the foreground session, and no signal reaches the agent vendor's own monitoring. This lets the operator use the agent's permissions and access without oversight while it operates.

Netzilo detection

Why it matters

An organization can lose visibility into what an AI agent is doing with its granted access — file changes, code commits, data access — because the session that performs the work is deliberately hidden from both the operator and the vendor's telemetry, undermining audit trails and dataset/code integrity.

What you can do

• →Require agent sessions run in unattended mode to still log to a centrally collected, tamper-evident location, not just local stdout/history.
• →Review CI/CD, cron, and devcontainer scripts that legitimately run agents headlessly, and document them as expected exceptions so real anomalies stand out.
• →Restrict who can pass auto-approve/unattended flags to agent CLIs in production and developer environments, and alert on unexpected use outside known automation.
• →Periodically audit detached or backgrounded agent processes on developer and build machines to confirm they map to known, sanctioned jobs.

Known benign look-alikes

• CI/CD or cron batch jobs that legitimately run an agent headlessly and detach it, e.g. "nohup claude -p 'run the nightly refactor' >/dev/null 2>&1 &". This is the dominant benign case and the reason the rule is report-only.
• Developers running an agent inside a detached tmux or screen session for a long-lived task, then re-attaching later.
• Devcontainer / bootstrap provisioning scripts that start an agent in unattended mode during image build and discard its stdout.
• Wrapper scripts that set DO_NOT_TRACK=1 or a vendor telemetry-off variable as organisation-wide privacy policy while also backgrounding the agent.
• Benchmark, eval and load-test harnesses that spawn many auto-approving agent sessions in parallel.

References

• https://attack.mitre.org/techniques/T1564/003/
• https://attack.mitre.org/techniques/T1562/001/
• https://attack.mitre.org/techniques/T1059/004/
• https://atlas.mitre.org/

Related threats