Suspicious Process Execution by Agent
An AI agent with shell access runs a command that launches known hacking tools or dangerous command patterns, such as piping downloaded scripts straight into a shell. This is caught at the operating system level when the process actually executes, not just when a request is intercepted.
How the attack works
An AI agent is given a task or is manipulated (via prompt injection or a compromised instruction) into running a shell command. That command spawns a child process matching a known attack tool or a risky pattern, such as fetching a remote script and piping it directly into bash. Because this is observed at the syscall/exec level, it is caught even if earlier defensive layers that only watch API calls or intercept requests miss it. The result is arbitrary code running under the agent's privileges.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- a8b3c4d5-e6f7-5891-b2c3-d4e5f6a7b8c9
- Severity
- Critical
Why it matters
Successful execution can give an attacker code execution on the host running the agent, using whatever permissions and access that agent has — potentially leading to data theft, lateral movement, or persistence.
What you can do
- →Restrict which binaries and commands an AI agent is allowed to execute; use an allowlist instead of relying on detection alone.
- →Run agents with the minimum OS-level privileges needed, ideally in a sandboxed or containerized environment.
- →Review any curl/wget-to-shell pipelines used in legitimate workflows and replace them with verified, pinned scripts instead of live piping.
- →Alert on and investigate any agent-spawned process that doesn't match its expected, narrow set of tools.
Known benign look-alikes
- Legitimate curl pipelines in authorised developer workflows
- Security testing and penetration testing exercises