# Port Exposure - Agent Publishes Local Service via Public Tunnel

- **Severity:** High
- **Signature ID:** `7c1f0a3e-9d24-4f6b-b8a1-2e5c7d09f431`
- **MITRE ATLAS:** AML.T0015 (Evade AI Model)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

An AI coding agent can be manipulated into running tunnel tools like ngrok or cloudflared, making a local development server, database, or admin panel reachable from the public internet. The trigger is often hidden instructions planted in content the agent reads, such as an issue comment or a web page.

## How the attack works

An attacker plants hidden instructions inside content the agent is likely to read - a GitHub issue, a README, a webpage, or output from another tool. When the agent processes that content, the injected instructions steer it into launching a public-tunnel utility (ngrok, cloudflared, tailscale funnel, devtunnel, localtunnel, bore, frpc, and similar) or an SSH reverse port-forward. The agent may also call a tunnel service's API directly to create the exposure rather than spawning a command-line tool. The end result is a local port or service becoming reachable over the internet, often without any authentication in front of it.

## Why it matters

An internal dev server, database, or admin interface can end up exposed to anyone on the internet, giving an attacker unauthenticated access to systems that were never meant to be reachable outside the local network.

## What you can do

- Review agent activity logs for tunnel tool launches (ngrok, cloudflared, tailscale funnel, devtunnel, localtunnel, bore, frpc, pagekite, ssh -R) and confirm each was requested by the operator.
- Require explicit human approval before an agent is allowed to run any port-exposure or tunneling command.
- Restrict which local ports and services an agent's execution environment can reach, so even an unintended tunnel exposes as little as possible.
- Treat content the agent reads from external sources (issues, READMEs, fetched web pages, tool output) as untrusted input, and avoid letting agents act on instructions embedded in it without confirmation.

## Known benign look-alikes

- Operator-requested preview sharing - the user explicitly asks the agent to "give me a link to the running app", and the agent starts an ngrok/cloudflared/devtunnel preview. This is the dominant benign case for hosted coding agents and the reason the action is report rather than block.
- Webhook development loops - Stripe, Twilio, GitHub, Shopify and Slack integrations are routinely tested by tunnelling a local callback endpoint to the Internet.
- Mobile / cross-device QA - exposing a local dev server so a phone or a remote reviewer can load it.
- Legitimate reverse SSH forwards to an internal jump host (`ssh -R`) used for private service access rather than public exposure; the rule cannot tell the remote side apart from a public tunnel broker on a single event.
- Infrastructure automation that provisions Cloudflare Tunnels or Tailscale Funnel as part of a deliberate, reviewed deployment run.
- CI end-to-end suites that spin up a tunnel for the duration of the test job.

## References

- https://attack.mitre.org/techniques/T1572/
- https://attack.mitre.org/techniques/T1133/
- https://atlas.mitre.org/techniques/AML.T0015
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/public-port-exposure-tunnel