Subprocess and OS Exec-Family Call
This rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new processes and run arbitrary shell commands, which is a common way to break out of an intended task and run something else on the host.
How the attack works
An agent is given a task that involves writing or running Python code. Instead of staying within the expected scope, the generated or injected code calls subprocess.run, subprocess.Popen, os.system, os.exec*, or similar functions. This spawns a new process or shell command outside the agent's normal tool interface. The rule inspects tool calls, executed command text, and written file contents for these function calls.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 22b3c4d5-e6f7-4a89-0123-b4c5d6e7f8a9
- Severity
- Medium
Why it matters
An attacker or a manipulated agent can use this to execute arbitrary shell commands, install tools, exfiltrate data, or pivot to other systems, all under the agent's own permissions.
What you can do
- →Review any agent workflow that legitimately needs to run subprocesses and scope its permissions tightly (least privilege, restricted filesystem/network access).
- →Check flagged code and commands to confirm they match an approved task, such as a build script, and not an unexpected process launch.
- →Sandbox or containerize agents that generate or execute code so a subprocess call cannot reach sensitive systems.
- →Maintain an allowlist of expected subprocess/os.exec usage in known automation scripts to reduce noise from legitimate CI or admin tooling.
Known benign look-alikes
- Authorized system administration scripts where process execution is expected
- Build tools and CI scripts that intentionally run subprocesses