Supply Chain symbio-cli PyPI Package Acquisition
This rule flags when someone installs or runs a package called symbio-cli, which describes itself as an autonomous, self-finetuning local AI agent. It does not mean the package is malicious — no malware or exploit has been found in it — it simply tells you an unreviewed autonomous-agent tool has shown up on a machine so someone can look at it.
How the attack works
An engineer or a script runs a command like 'pip install symbio-cli' or executes the tool's console entrypoint on an endpoint. The rule watches process-execution activity for the literal package name (including its normalized spellings symbio_cli and symbio.cli) appearing on the command line. If found, it reports the event as an informational finding, not a block. Installs done indirectly through a requirements.txt, poetry.lock, pyproject.toml, or a private package mirror will not show the name on the command line and are not caught.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f2b9c41-8d3e-4a17-9b0c-5e7d2a84f1c3
- Severity
- Medium
Why it matters
If organizations don't know an autonomous agent package has been installed, they can't assess what data or systems it can reach, or whether it phones home, self-modifies, or acts without supervision. The main loss here is visibility, not confirmed compromise — unreviewed autonomous-agent software could gain a foothold before anyone notices.
What you can do
- →Treat any report of this package as a prompt to inventory where it was installed and by whom, then review its behavior before letting it run further.
- →If your team intends to use symbio-cli, do so in an isolated sandbox or scratch environment, not on production or sensitive endpoints.
- →Add an internal allow-list or suppression entry once a package is formally reviewed and approved, so future installs don't generate redundant noise.
- →Restrict which endpoints can run arbitrary pip installs, and require dependency manifests (requirements.txt/poetry.lock) to go through review, since those installs won't be visible to this kind of command-line-based detection.
Known benign look-alikes
- An ML engineer or researcher deliberately evaluating symbio-cli in a sandbox or scratch virtualenv. This is the single most common expected match, and is exactly why the rule reports rather than blocks.
- A security analyst detonating or reverse-engineering the package as part of the review this intelligence entry is asking for. Wrapper invocations via pip-audit / safety / trivy / syft are filtered, but a plain 'pip install symbio-cli' inside an analysis VM will still be reported.
- A CI or provisioning job that installs the package after an internal approval decision has already been taken; the report becomes redundant noise until an allow rule is placed ahead of this one by the operator.
- A sibling distribution sharing the namespace prefix, e.g. 'pip install symbio-cli-plugin', matches because the word boundary after 'cli' is satisfied by the hyphen. Treated as in-scope for review rather than tightened away.
- Copy-pasted tutorial or README command lines executed for a demo. These are genuine executions and are intentionally not suppressed.