OpenClaw Suspicious File Write to Sensitive Paths

How the attack works

An agent with file-editing or shell-command tools is directed (by a user, a compromised prompt, or a malicious task) to modify a sensitive path. The rule watches for this either through direct file-write/edit tool calls that target the path, or through Bash commands that redirect output into the file (e.g. appending a line to .bashrc or a cron file). Once such a write lands in one of these locations, code placed there will execute automatically on the next login, cron cycle, shell start, or reboot — giving the attacker a foothold that survives the current session.

Netzilo detection

Why it matters

An attacker who reaches this point gains persistent code execution on the host, meaning they keep control even after the original session ends or the agent is shut down.

What you can do

• →Restrict which paths an AI agent's file-write and shell tools are allowed to touch, and deny writes to startup/cron/SSH configuration directories by default.
• →Review any agent-driven changes to .bashrc, .profile, crontab, systemd unit files, LaunchAgents, or authorized_keys before allowing them to run.
• →Require human approval for shell commands that redirect into these paths, rather than letting agents execute them autonomously.
• →Keep a change log or file-integrity monitor on these specific paths so unexpected edits are caught quickly, whatever the source.

Known benign look-alikes

• Legitimate system configuration management by authorised tools
• Development scripts that modify shell profiles during environment setup

References

• https://attack.mitre.org/techniques/T1546/
• https://attack.mitre.org/techniques/T1053/

Related threats