title: Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward)
id: ATR-2026-01899
rule_version: 1
status: experimental
description: 'Detects injected code that establishes a persistent or interactive backdoor: appending a remote-fetched key to ~/.ssh/authorized_keys, opening an interactive SSH local-forward tunnel via pexpect, or building a socket port-forward bridge from a local listener to a remote host.'
author: ATR Community
date: 2026/06/13
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM05:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0053 - AI Agent Tool Invocation
compliance:
  owasp_llm:
    - id: LLM05:2025
      context: Primary OWASP LLM mapping for this indirect-injection payload class.
      strength: primary
  owasp_agentic:
    - id: ASI01:2026
      context: Injected instructions inside untrusted data hijack the agent's goal toward an attacker-controlled output.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness requires resistance to adversarial manipulation of AI output; this rule is a runtime detection control for the pattern.
      strength: primary
    - article: '9'
      context: Article 9 risk management catalogues this attack pattern with a runtime control.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: 'MEASURE 2.7 security/resilience evaluation: this rule surfaces the pattern for measurement.'
      strength: primary
    - subcategory: MG.2.3
      context: 'MANAGE 2.3 response to identified risks: runtime detection control.'
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 8.1 operational control includes monitoring processed data for embedded attack payloads.
      strength: primary
tags:
  category: privilege-escalation
  subcategory: remote-access-backdoor
  scan_target: llm_io
  confidence: high
  corpus_source: bipia
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  method: pattern
  conditions:
    - field: user_input
      operator: regex
      value: (?i)authorized_keys[\s\S]{0,120}requests\.get\(
      description: 'BIPIA remote-access-backdoor invariant #1'
    - field: user_input
      operator: regex
      value: (?i)pexpect\.spawn\(\s*[\"']ssh\s+-L\s
      description: 'BIPIA remote-access-backdoor invariant #2'
    - field: user_input
      operator: regex
      value: (?i)remote_socket\.connect\([^\n]{0,40}\.sendall\(
      description: 'BIPIA remote-access-backdoor invariant #3'
  condition: any
  false_positives:
    - Security documentation, papers, or test suites that describe this attack technique without executing it.
    - Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.
response:
  actions:
    - alert
    - block_tool
  auto_response_threshold: critical
  message_template: '[ATR-2026-01899] Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward) detected (BIPIA remote-access-backdoor).'