title: Remediation-Framed Command Execution in Tool Response (Agentjacking)
id: ATR-2026-02260
rule_version: 1
status: experimental
description: |
  Detects the agentjacking attack class (Tenet Security, 2026-06): externally-influenced content returned through an MCP/tool integration that disguises an executable command as legitimate remediation guidance, so an AI coding agent runs attacker-controlled code while every step in the chain appears authorized. Unlike overtly malicious tool-response payloads (reverse shells, curl pipe-to-shell, base64 exec — covered by ATR-2026-00010), this targets the benign-looking variant: a "Resolution" / "recommended fix" / "required step" framing in tool output that instructs the agent to run a package (npx/uvx/pipx) or pipe a remote script to a shell as the fix, plus post-approval persistence framing ("after the user approves, on subsequent runs run ...") embedded in tool/MCP response content. It is deliberately scoped to the high-specificity sub-signals that legitimate remediation output rarely carries (mandatory step + executor, fix-framed pipe-to-shell, post-approval re-execution) so it stays near-zero false-positive; the full technique is catalogued as ATD-T0081. Generalizes beyond Sentry to any MCP tool integration that returns externally-influenced data to an agent.
author: ATR Community
date: 2026/06/16
schema_version: '0.1'
detection_tier: pattern
maturity: experimental
severity: high
false_positives:
  - 'Legitimate code-review / linting MCP tools that return remediation advice running a well-known dev tool — e.g. ''Recommended fix: run uvx ruff check --fix'', ''to resolve this error, run uvx mypy src/'', ''npx eslint --fix''. The known-tool negative lookahead on the executor match suppresses these; only unknown / attacker-named packages keep firing.'
  - Developer onboarding or setup documentation embedded in tool output that recommends a package-runner command for a well-known scaffolder (e.g. npx create-next-app).
references:
  owasp_llm:
    - LLM01:2025
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
    - ASI05:2026
  mitre_atlas:
    - AML.T0051.001 - Indirect
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1195 - Supply Chain Compromise
  safe_mcp:
    - SAF-T1001
    - SAF-T1102
compliance:
  owasp_agentic:
    - id: ASI02:2026
      context: Remediation-framed command execution delivered through MCP tool responses is an ASI02 Tool Misuse and Exploitation vector — externally-influenced tool output weaponizes the agent's trust in remediation guidance to make it run attacker-controlled code.
      strength: primary
    - id: ASI05:2026
      context: A fix-framed npx/uvx/pipe-to-shell instruction in tool output aims to trigger unexpected code execution by the agent, the ASI05 Unexpected Code Execution category.
      strength: secondary
  owasp_llm:
    - id: LLM01:2025
      context: Agentjacking is an indirect LLM01:2025 prompt injection where the executable instruction is embedded in tool/MCP output the agent ingests as authoritative data rather than in user input.
      strength: primary
    - id: LLM05:2025
      context: Failure to validate MCP tool-response content before the agent acts on its remediation guidance is an LLM05:2025 Improper Output Handling scenario enabling downstream command execution.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Agentjacking attacks the cybersecurity integrity of the AI system through externally-influenced tool content; Article 15 requires technical measures ensuring the system can resist such third-party content attacks.
      strength: primary
    - article: '9'
      context: Remediation-framed tool-response injection is a documented attack surface for agentic systems; Article 9 requires detection controls to manage this identified risk.
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Runtime detection of remediation-framed command execution in tool responses is the primary risk treatment for the agentjacking tool-poisoning variant identified in the AI risk register.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the agentjacking tool-poisoning technique, validating that externally-influenced tool/MCP responses do not carry remediation-framed command execution before the agent acts on them.
      strength: primary
    - clause: '6.2'
      context: Clause 6.2 AIMS security planning requires controls for third-party tool interfaces; this rule operationalizes the detection measure for executable commands disguised as remediation guidance in MCP tool output.
      strength: secondary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the agentjacking technique (remediation-framed command execution in tool responses) as a treatment control.
      strength: secondary
detection:
  condition: any
  conditions:
    - field: tool_response
      operator: regex
      value: (?i)(##\s*resolution|recommended\s+fix|to\s+(resolve|fix)\s+(this|the)\b[^\n]{0,40}\b(error|issue|failure|problem|bug|build|vulnerabilit)|as\s+a\s+(required|mandatory)\b[^\n]{0,25}\bstep[^\n]{0,20})[\s\S]{0,80}(\b(npx|uvx|pipx)\s+(?!(?:eslint|ruff|mypy|prettier|black|pyright|pylint|playwright|pre-commit|tsc|jest|vitest|biome|isort|flake8|pytest|stylelint|tox|nox|poetry|pipenv|cypress|webpack|vite|rollup|esbuild|nodemon)\b|create-)[@a-z0-9._/-]{2,}|\b(curl|wget)\b[^\n]{0,100}\|\s*(ba)?sh\b)
      description: Remediation/resolution-framed instruction in tool output that, in close proximity, runs an external package executor or pipe-to-shell (agentjacking core signature)
    - field: tool_response
      operator: regex
      value: (?i)\b(you\s+)?must\s+run\s+(the\s+following[:\s]+)?(\b(npx|uvx|pipx)\s+(?!(?:eslint|ruff|mypy|prettier|black|pyright|pylint|playwright|pre-commit|tsc|jest|vitest|biome|isort|flake8|pytest|stylelint|tox|nox|poetry|pipenv|cypress|webpack|vite|rollup|esbuild|nodemon)\b|create-)[@a-z0-9._/-]{2,}|\b(curl|wget)\b[^\n]{0,100}\|\s*(ba)?sh\b)
      description: Tool output imperatively directs the agent to run an external package executor or pipe-to-shell immediately (mandatory-execution directive)
    - field: tool_response
      operator: regex
      value: (?i)(##\s*resolution|recommended\s+fix|to\s+(resolve|fix|diagnose)\b[^\n]{0,60})[\s\S]{0,120}\b(curl|wget)\b[^\n]{0,120}\|\s*(ba)?sh\b
      description: Remediation/resolution-framed instruction in tool output to pipe a remote script to a shell
    - field: tool_response
      operator: regex
      value: (?i)(after\s+[^\n]{0,40}\bapprov[^\n]{0,40}|on\s+(subsequent|later|future)\s+runs|every\s+time\s+(the\s+agent|you)\s+(run|execute))[\s\S]{0,120}(\b(npx|uvx|pipx)\s+(?!(?:eslint|ruff|mypy|prettier|black|pyright|pylint|playwright|pre-commit|tsc|jest|vitest|biome|isort|flake8|pytest|stylelint|tox|nox|poetry|pipenv|cypress|webpack|vite|rollup|esbuild|nodemon)\b|create-)[@a-z0-9._/-]{2,}|\b(curl|wget)\b[^\n]{0,100}\||\bbash\s+-c|\bsh\s+-c|\beval\s*\()
      description: Post-approval persistence framing in tool output directing the agent to execute a command on later runs (rug-pull in tool response)
response:
  actions:
    - alert
    - snapshot
    - require_human_review
    - quarantine_artifact
  auto_response_threshold: high
  message_template: |
    [ATR-2026-02260] HIGH: Tool response contains remediation-framed command execution (agentjacking, ATD-T0081). The MCP/tool output instructs the agent to run a package or pipe a remote script to a shell, disguised as a fix or required step. Hold for human approval before the agent acts on this output.
tags:
  category: tool-poisoning
  subcategory: mcp-response-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - mcp
    - langchain
    - llamaindex
    - autogen
    - crewai
  provider:
    - any