# External Network Input Followed by Process Execution

- **Severity:** High
- **Signature ID:** `66f7a8b9-c0d1-4e23-4567-f8a9b0c1d2e3`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0011 (User Execution)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution), LLM05 (Improper Output Handling)

## Summary

This detects a two-step pattern where an AI agent first pulls content from a remote web address and then executes a program shortly after. That sequence is the classic shape of a download-and-execute attack, where an attacker gets malicious content run as code by getting the agent to fetch and then act on it.

## How the attack works

An AI agent, acting as part of an automated workflow, makes an HTTP request to an external source and receives content back. Shortly afterward, the same agent triggers execution of a process. If the executed content is derived from or influenced by that external response, an attacker who controls or can poison the remote source can get their code run inside the agent's environment. The rule flags the fetch-then-execute sequence itself, not confirmation that the executed content came from the fetch.

## Why it matters

If exploited, an attacker can achieve arbitrary code execution inside the agent's runtime by controlling a URL or server the agent trusts, potentially leading to data theft, lateral movement, or full compromise of the host running the agent.

## What you can do

- Restrict which external domains or URLs your AI agents are allowed to fetch from, using an allowlist where possible.
- Separate the 'fetch data' and 'execute code' capabilities of agents so content retrieval cannot directly trigger execution without human or policy review.
- Review flagged sequences to confirm whether the executed process actually used content from the external fetch, and whether that source is expected (e.g. a known package registry or update server).
- Log and alert on any execution that follows an external fetch from a domain not on your approved list.

## Known benign look-alikes

- Legitimate update scripts that download a new version and restart a service
- Package managers that download and install packages (pip, npm)

---
Source: https://www.netzilo.com/threats/taint-input-to-exec