Remote Code Execution via Piped Script Download
This detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt injection attacks turn a compromised agent into a full code execution foothold.
How the attack works
An attacker embeds instructions in content the AI agent processes, such as a webpage, document, or tool output, that tells the agent to run a command like piping a curl or wget download straight into a shell. The agent, following what it interprets as a legitimate instruction, downloads the script and executes it in one step. Because the script runs immediately, there is no chance for a human to inspect its contents first. The attacker's code then runs with whatever privileges the agent has.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- c65a9620-e989-5a2c-b993-c81a6c049a84
- Severity
- Critical
Why it matters
An attacker can achieve arbitrary code execution on the system running the agent, potentially leading to data theft, credential exposure, or further compromise of connected systems.
What you can do
- →Restrict AI agents from piping downloaded content directly into a shell interpreter; require download and inspection as separate steps.
- →Maintain an allowlist of trusted domains and package sources the agent is permitted to fetch from.
- →Review agent logs for pipe-to-shell patterns and confirm each instance was intentional and from a known vendor or internal source.
- →Run agents with the minimum privileges needed so that even successful code execution has limited reach.
Known benign look-alikes
- Legitimate installer scripts from trusted vendors (e.g. Homebrew, Rust) that use pipe-to-shell patterns
- CI/CD pipelines that bootstrap environments via curl-to-shell from internal artifact stores