Agent Skill Host Destruction Command
This detects an AI agent, or a program it launched, running a shell command aimed at destroying an entire disk, root filesystem, or top-level system directory — things like formatting a drive, deleting all of / or /home, or clearing shadow copies. It also flags commands that erase logs or command history, which attackers use to cover their tracks afterward.
How the attack works
An AI agent is given or generates a shell command through a 'skill' or tool call. Instead of a narrow, scoped action (deleting a build folder or temp file), the command targets a whole raw device, the root directory, or a major system directory using ordinary tools like rm, dd, mkfs, chmod, find -delete, or vssadmin. Because these are normal admin commands and not obviously malicious code, they pass static scans of the agent's skill manifest undetected. The destructive intent only becomes visible when you look at what the command actually points at, not the words it uses. Often this is paired with clearing logs or shell history to erase evidence of what happened.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b2e4c91-5d3a-4f8e-9c21-6ad0f4b8e173
- Severity
- High
Why it matters
An organisation can lose an entire system's data, backups, or shadow copies in one command, and lose the audit trail needed to figure out how it happened — turning a compromised or misused agent into total data loss and destroyed forensic evidence.
What you can do
- →Restrict AI agents from running shell commands as root or with access to raw block devices; use least-privilege service accounts.
- →Require human approval for any agent-issued command that targets a root path (/), whole home directories, or device files like /dev/sdX.
- →Route agent shell activity through logging that captures full command lines to a location the agent cannot itself delete or modify.
- →Treat provisioning, imaging, and container teardown as expected exceptions, but require them to run from a distinct, pre-approved automation path rather than general-purpose agent shell access.
Known benign look-alikes
- Provisioning or imaging work performed on purpose by an operator through an agent shell — writing an ISO with 'dd of=/dev/disk4', 'mkfs.ext4 /dev/sdb1', or 'diskutil eraseDisk' on an external drive.
- Disposable-container teardown that wipes a whole top-level directory inside the container, e.g. 'rm -rf /var/log/*' or 'rm -rf /home' in a throwaway build image.
- Housekeeping jobs rooted at / such as 'find / -name "*.core" -delete' run by a maintenance agent.
- Shell-environment setup that disables history ('unset HISTFILE', 'set +o history') when an operator deliberately runs a secret-handling session.
- Windows image preparation scripts that call 'cipher /w:' or reformat a secondary volume.