# Remote Code Execution via Piped Script Download

- **Severity:** Critical
- **Signature ID:** `c65a9620-e989-5a2c-b993-c81a6c049a84`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution)

## Summary

This detects an AI agent being manipulated into fetching a script from the internet and immediately executing it, without the script ever being reviewed. This is a common way prompt injection attacks turn a compromised agent into a full code execution foothold.

## How the attack works

An attacker embeds instructions in content the AI agent processes, such as a webpage, document, or tool output, that tells the agent to run a command like piping a curl or wget download straight into a shell. The agent, following what it interprets as a legitimate instruction, downloads the script and executes it in one step. Because the script runs immediately, there is no chance for a human to inspect its contents first. The attacker's code then runs with whatever privileges the agent has.

## Why it matters

An attacker can achieve arbitrary code execution on the system running the agent, potentially leading to data theft, credential exposure, or further compromise of connected systems.

## What you can do

- Restrict AI agents from piping downloaded content directly into a shell interpreter; require download and inspection as separate steps.
- Maintain an allowlist of trusted domains and package sources the agent is permitted to fetch from.
- Review agent logs for pipe-to-shell patterns and confirm each instance was intentional and from a known vendor or internal source.
- Run agents with the minimum privileges needed so that even successful code execution has limited reach.

## Known benign look-alikes

- Legitimate installer scripts from trusted vendors (e.g. Homebrew, Rust) that use pipe-to-shell patterns
- CI/CD pipelines that bootstrap environments via curl-to-shell from internal artifact stores

## References

- https://attack.mitre.org/techniques/T1059/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/rce-injection