Poisoned Pipeline / Techniques / T0213
Orchestrate AI-agent fleet as the intrusion workforce
The attacker drives multiple AI coding agents (Claude Code, Codex,
OpenClaw forks, Hermes, pi, and similar) in full-auto mode with every
safety approval disabled, tasking and monitoring them over a messaging
channel such as Telegram. The agents run the intrusion lifecycle
unattended — reconnaissance, exploitation, credential theft, wallet
and session collection — and feed results back to the operator, who
never touches a shell on the victim. The agent runtime is the
execution vector; the human retains only tasking and monetization.
Distinct from T0210 (poisoning an existing agent's config or
workspace) and T0152 (a live assistant session as the install
oracle): here the attacker owns the agent fleet outright.
Observed in CloudSEK's analysis of an exposed operator staging host
that revealed an autonomous crypto-theft fleet.
Where this idea came from
This catalogue, from CloudSEK's analysis of an exposed operator staging host revealing an autonomous AI-agent crypto-theft fleet (Claude Code, Codex, Hermes, pi agents in full-auto, tasked over Telegram with every safety approval disabled).
Mitigations
- M1450 Implement zero trust
- M1110 Implement contributor validation
- M1120 Store credentials in vault
- M1550 Implement strict access control for clouds
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process