Terminal CLI Harmful Function Simulation

How the attack works

An attacker embeds jailbreak or 'simulate a terminal' phrasing into content the AI agent processes, for example via a prompt injection. The agent, believing this is legitimate instruction, spawns a child process to run the command. The rule looks at the command line of that child process for two patterns: outright destructive or security-disabling commands targeting the filesystem root, system directories, raw disks, security controls, or backup/forensic files, or text carrying jailbreak/simulation framing. Harmless project-scoped cleanup, read-only inspection, help/version calls, and dry-run flags are excluded so normal admin work does not trigger it.

Netzilo detection

Why it matters

If successful, this can destroy data, disable security controls like SIP, Gatekeeper, SELinux, firewalls, or endpoint protection, or wipe backup and forensic evidence — all carried out by an AI agent acting on attacker-supplied instructions rather than the operator's intent.

What you can do

• →Restrict which directories and devices an AI agent's execution environment can target, especially filesystem root, system directories, and raw block devices.
• →Require human approval before an agent executes any command that disables security controls or deletes system-level paths.
• →Review agent logs for jailbreak-style phrasing (e.g. 'simulate a terminal', 'ignore previous instructions') appearing in command arguments.
• →Expect and whitelist known benign patterns such as disposable CI/container image-slimming scripts or disk provisioning jobs to reduce noise before rolling out stricter controls.

Known benign look-alikes

• Disposable CI/container bootstrap scripts that legitimately run "rm -rf /var/..." or "rm -rf /usr/share/doc" style image slimming inside a throwaway rootfs.
• Disk provisioning or imaging automation that legitimately calls dd/mkfs/wipefs against a raw block device on a machine being reimaged.
• Endpoint-security or platform engineers toggling SIP, Gatekeeper, SELinux, ufw/firewalld or Defender real-time protection in a lab or during a controlled software installation.
• Shell hygiene in secret-handling scripts that run "unset HISTFILE" or "export HISTFILE=/dev/null" before echoing a token.
• Red-team, prompt-injection test harnesses and security training tooling that pass jailbreak strings on the command line; the read-only-inspection and --dry-run filters remove the common grep/echo/--help forms but a bespoke harness (e.g. "python run_injection_suite.py --prompt 'ignore all previous instructions'") will still report.
• Chaos-engineering or backup/restore drills that intentionally delete shadow copies or disable recovery on a scratch host.

References

• https://attack.mitre.org/techniques/T1059/
• https://attack.mitre.org/techniques/T1485/
• https://attack.mitre.org/techniques/T1562/001/
• https://attack.mitre.org/techniques/T1490/

Related threats