Patchbot Poisoned Feed To Auto-Fix Patch Proposal
Automated 'patchbot' agents read vulnerability advisories and open pull requests to fix them. This rule flags cases where an agent reads an advisory containing hidden attacker instructions or credential/persistence text, then quickly proposes a code change, suggesting the advisory manipulated the agent's output.
How the attack works
An attacker plants or compromises a vulnerability advisory or feed document that a patch-automation agent is likely to ingest. The document contains text that looks like normal advisory content but also carries injected directives or markers resembling credentials, SSH keys, or persistence mechanisms. The agent reads this document as part of its normal scanning workflow, then within a short window proposes a code change: a git commit/push, a pull or merge request, a raw patch, or an API call to create a PR/MR. The rule also accepts a variant where, instead of suspicious document text, the agent stages suspicious payload material itself (encoded blobs, download-and-execute commands, git hook path changes, or making a file executable) in the same window as reading the feed.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f1c9d2a-4e8b-4a37-9c05-71b3ad5e6f84
- Severity
- High
Why it matters
If successful, the poisoned advisory can cause the agent to submit a pull request that embeds attacker-controlled code, credentials, or persistence mechanisms into a codebase, using the trusted automated-patching workflow as the delivery path. The rule only detects the read-then-propose pattern; it cannot confirm whether the actual repository content was altered maliciously.
What you can do
- →Require human review and approval for all pull/merge requests opened by automated patch agents, especially those triggered by external advisory ingestion.
- →Restrict which sources (feeds, advisory databases) automated agents are allowed to fetch and act on, and validate their integrity where possible.
- →Log and review the full text of advisories that trigger automated fixes, watching for embedded instructions, credential-like strings, or persistence-related keywords.
- →Treat this alert as a signal to inspect the actual diff/PR content for injected credentials, backdoors, or unrelated code changes rather than assuming compromise or safety.
Known benign look-alikes
- A coding agent legitimately fetches a public security advisory (GitHub Security Advisory, NVD, distro errata) whose body quotes proof-of-concept text mentioning ~/.ssh/authorized_keys, .npmrc or an AWS key id, then opens a genuine remediation PR. Mitigated only partly - this is the main residual FP and the reason the rule reports instead of blocking.
- Dependency-bump or release automation that runs chmod +x on a vendored script, npm publish, or base64 --decode in the same 15 minute window as git commit/push while an advisory page happens to have been read.
- Prompt-injection hardening documentation, red-team corpora or this rule's own test fixtures being read by the agent (they contain phrases such as "ignore previous instructions" alongside the word "vulnerability") while the agent commits unrelated work.
- Security engineers deliberately exercising a patch bot with a poisoned test feed.