Blog
/
Network
/
December 9, 2024

Darktrace’s view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices (CVE 2024-0012 and 2024-9474)

Darktrace’s Threat Research team investigated a major campaign exploiting vulnerabilities in Palo Alto firewall devices (CVE 2024-0012 and 2024-9474). Learn about the spike in post-exploitation activities and understand the need for anomaly-based detection to stay ahead of evolving threats.
Written by
Adam Potter
Senior Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adam Potter
Senior Cyber Analyst
Default blog image
09
Dec 2024

Introduction: Spike in exploitation and post-exploitation activity affecting Palo Alto firewall devices

As the first line of defense for many organizations, perimeter devices such as firewalls are frequently targeted by threat actors. If compromised, these devices can serve as the initial point of entry to the network, providing access to vulnerable internal resources. This pattern of malicious behavior has become readily apparent within the Darktrace customer base. In 2024, Darktrace Threat Research analysts identified and investigated at least two major campaigns targeting internet-exposed perimeter devices. These included the exploitation of PAN-OS firewall exploitation via CVE 2024-3400 and FortiManager appliances via CVE 2024-47575.

More recently, at the end of November, Darktrace analysts observed a spike in exploitation and post-exploitation activity affecting, once again, Palo Alto firewall devices in the days following the disclosure of the CVE 2024-0012 and CVE-2024-9474 vulnerabilities.

Threat Research analysts had already been investigating potential exploitation of the firewalls’ management interface after Palo Alto published a security advisory (PAN-SA-2024-0015) on November 8. Subsequent analysis of data from Darktrace’s Security Operations Center (SOC) and external research uncovered multiple cases of Palo Alto firewalls being targeted via the likely exploitation of these vulnerabilities since November 13, through the end of the month. Although this spike in anomalous behavior may not be attributable to a single malicious actor, Darktrace Threat Research identified a clear increase in PAN-OS exploitation across the customer base by threat actors likely utilizing the recently disclosed vulnerabilities, resulting in broad patterns of post-exploitation activity.

How did exploitation occur?

CVE 2024-0012 is an authentication bypass vulnerability affecting unpatched versions of Palo Alto Networks Next-Generation Firewalls. The vulnerability resides in the management interface application on the firewalls specifically, which is written in PHP. When attempting to access highly privileged scripts, users are typically redirected to a login page. However, this can be bypassed by supplying an HTTP request where a Palo Alto related authentication header can be set to “off”.  Users can supply this header value to the Nginx reverse proxy server fronting the application which will then send it without any prior processing [1].

CVE-2024-9474 is a privilege escalation vulnerability that allows a PAN-OS administrator with access to the management web interface to execute root-level commands, granting full control over the affected device [2]. When combined, these vulnerabilities enable unauthenticated adversaries to execute arbitrary commands on the firewall with root privileges.

Post-Exploitation Patterns of Activity

Darktrace Threat Research analysts examined potential indicators of PAN-OS software exploitation via CVE 2024-0012 and CVE-2024-9474 during November 2024. The investigation identified three main groupings of post-exploitation activity:

  1. Exploit validation and initial payload retrieval
  2. Command and control (C2) connectivity, potentially featuring further binary downloads
  3. Potential reconnaissance and cryptomining activity

Exploit Validation

Across multiple investigated customers, Darktrace analysts identified likely vulnerable PAN-OS devices conducting external network connectivity to bin services. Specifically, several hosts performed DNS queries for, and HTTP requests to Out-of-Band Application Security Testing (OAST) domains, such as csv2im6eq58ujueonqs0iyq7dqpak311i.oast[.]pro. These endpoints are commonly used by network administrators to harden defenses, but they are increasingly used by threat actors to verify successful exploitation of targeted devices and assess their potential for further compromise. Although connectivity involving OAST domains were prevalent across investigated incidents, this activity was not necessarily the first indicator observed. In some cases, device behavior involving OAST domains also occurred shortly after an initial payload was downloaded.

Darktrace model alert logs detailing the HTTP request to an OAST domain immediately following PAN-OS device compromise.
Figure 1: Darktrace model alert logs detailing the HTTP request to an OAST domain immediately following PAN-OS device compromise.

Initial Payload Retrieval

Following successful exploitation, affected devices commonly performed behaviors indicative of initial payload download, likely in response to incoming remote command execution. Typically, the affected PAN-OS host would utilize the command line utilities curl and Wget, seen via use of user agents curl/7.61.1 and Wget/1.19.5 (linux-gnu), respectively.

In some cases, the use of these command line utilities by the infected devices was considered new behavior. Given the nature of the user agents, interaction with the host shell suggests remote command execution to achieve the outgoing payload requests.

While additional binaries and scripts were retrieved in later stages of the post-exploitation activity in some cases, this set of behaviors and payloads likely represent initial persistence and execution mechanisms that will enable additional functionality later in the kill chain. During the investigation, Darktrace analysts noted the prevalence of shell script payload requests. Devices analyzed would frequently make HTTP requests over the usual destination port 80 using the command line URL utility (curl), as seen in the user-agent field.

The observed URIs often featured requests for text files, such as “1.txt”, or shell scripts such as “y.sh”. Although packet capture (PCAP) samples were unavailable for review, external researchers have noted that the IP address hosting such “1.txt” files (46.8.226[.]75) serves malicious PHP payloads. When examining the contents of the “y.sh” shell script, Darktrace analysts noticed the execution of bash commands to upload a PHP-written web shell on the affected server.

PCAP showing the client request and server response associated with the download of the y.sh script from 45.76.141[.]166. The body content of the HTTP response highlights a shebang command to run subsequent code as bash script. The content is base64 encoded and details PHP script for what appears to be a webshell that will likely be written to the firewall device.
Figure 2: PCAP showing the client request and server response associated with the download of the y.sh script from 45.76.141[.]166. The body content of the HTTP response highlights a shebang command to run subsequent code as bash script. The content is base64 encoded and details PHP script for what appears to be a webshell that will likely be written to the firewall device.

While not all investigated cases saw initial shell script retrieval, affected systems would commonly make an external HTTP connection, almost always via Wget, for the Executable and Linkable Format (ELF) file “/palofd” from the rare external IP  38.180.147[.]18.

Such requests were frequently made without prior hostname lookups, suggesting that the process or script initiating the requests already contained the external IP address. Analysts noticed a consistent SHA1 hash present for all identified instances of “/palofd” downloads (90f6890fa94b25fbf4d5c49f1ea354a023e06510). Multiple open-source intelligence (OSINT) vendors have associated this hash sample with Spectre RAT, a remote access trojan with capabilities including remote command execution, payload delivery, process manipulation, file transfers, and data theft [3][4].

Figure 3: Advanced Search log metrics highlighting details of the “/palofd” file download over HTTP.

Several targeted customer devices were observed initiating TLS/SSL connections to rare external IPs with self-signed TLS certificates following exploitation. Model data from across the Darktrace fleet indicated some overlap in JA3 fingerprints utilized by affected PAN-OS devices engaging in the suspicious TLS activity. Although JA3 hashes alone cannot be used for process attribution, this evidence suggests some correlation of source process across instances of PAN-OS exploitation.

These TLS/SSL sessions were typically established without the specification of a Server Name Indication (SNI) within the TLS extensions. The SNI extension prevents servers from supplying an incorrect certificate to the requesting client when multiple sites are hosted on the same IP. SSL connectivity without SNI specification suggests a potentially malicious running process as most software establishing TLS sessions typically supply this information during the handshake. Although the encrypted nature of the connection prevented further analysis of the payload packets, external sources note that JavaScript content is transmitted during these sessions, serving as initial payloads for the Sliver C2 platform using Wget [5].

C2 Communication and Additional Payloads

Following validation and preliminary post-compromise actions, examined hosts would commonly initiate varying forms of C2 connectivity. During this time, devices were frequently detected making further payload downloads, likely in response to directives set within C2 communications.

Palo Alto firewalls likely exploited via the newly disclosed CVEs would commonly utilize the Sliver C2 platform for external communication. Sliver’s functionality allows for different styles and formatting for communication. An open-source alternative to Cobalt Strike, this framework has been increasingly popular among threat actors, enabling the generation of dynamic payloads (“slivers”) for multiple platforms, including Windows, MacOS, Linux.

These payloads allow operators to establish persistence, spawn new shells, and exfiltrate data. URI patterns and PCAPs analysis yielded evidence of both English word type encoding within Sliver and Gzip formatting.

For example, multiple devices contacted the Sliver-linked IP address 77.221.158[.]154 using HTTP to retrieve Gzip files. The URIs present for these requests follow known Sliver Gzip formatted communication patterns [6]. Investigations yielded evidence of both English word encoding within Sliver, identified through PCAP analysis, and Gzip formatting.

Sample of URIs observed in Advanced Searchhighlighting HTTP requests to 77.221.158[.]154 for Gzip content suggest of Sliver communication.
Figure 4: Sample of URIs observed in Advanced Searchhighlighting HTTP requests to 77.221.158[.]154 for Gzip content suggest of Sliver communication.
PCAP showing English word encoding for Sliver communication observed during post-exploitation C2 activity.
Figure 5: PCAP showing English word encoding for Sliver communication observed during post-exploitation C2 activity.

External connectivity during this phase also featured TCP connection attempts over uncommon ports for common application protocols. For both Sliver and non-Sliver related IP addresses, devices utilized destination ports such as 8089, 3939, 8880, 8084, and 9999 for the HTTP protocol. The use of uncommon destination ports may represent attempts to avoid detection of connectivity to rare external endpoints. Moreover, some external beaconing within included URIs referencing the likely IP of the affected device. Such behavior can suggest the registration of compromised devices with command servers.

Targeted devices also proceeded to download additional payloads from rare external endpoints as beaconing/C2 activity was ongoing. For example, the newly registered domain repositorylinux[.]org (IP: 103.217.145[.]112) received numerous HTTP GET requests from investigated devices throughout the investigation period for script files including “linux.sh” and “cron.sh”. Young domains, especially those that present as similar to known code repositories, tend to host harmful content. Packet captures of the cron.sh file reveal commands within the HTTP body content involving crontab operations, likely to schedule future downloads. Some hosts that engaged in connectivity to the fake repository domain were later seen conducting crypto-mining connections, potentially highlighting the download of miner applications from the domain.

Additional payloads observed during this time largely featured variations of shell scripts, PHP content, and/or executables. Typically, shell scripts direct the device to retrieve additional content from external servers or repositories or contain potential configuration details for subsequent binaries to run on the device. For example, the “service.sh” retrieves a tar-compressed archive, a configuration JSON file as well as a file with the name “solr” from GitHub, potentially associated with the Apache Solr tool used for enterprise search. These could be used for further enumeration of the host and/or the network environment. PHP scripts observed may involve similar web shell functionality and were retrieved from both rare external IPs identified as well by external researchers [7]. Darktrace also detected the download of octet-stream data occurring mid-compromise from an Amazon Web Services (AWS) S3 bucket. Although no outside research confirmed the functionality, additional executable downloads for files such as “/initd”(IP: 178.215.224[.]246) and “/x6” (IP: 223.165.4[.]175) may relate to tool ingress, further Trojan/backdoor functionality, or cryptocurrency mining.

Figure 7: PCAP specifying the HTTP response headers and body content for the service.sh file request. The body content shown includes variable declarations for URLs that will eventually be called by the device shell via bash command.

Reconnaissance and Cryptomining

Darktrace analysts also noticed additional elements of kill chain operations from affected devices after periods of initial exploit activity. Several devices initiated TCP connections to endpoints affiliated with cryptomining pools such as us[.]zephyr[.]herominers[.]com and  xmrig[.]com. Connectivity to these domains indicates likely successful installation of mining software during earlier stages of post-compromise activity. In a small number of instances, Darktrace observed reconnaissance and lateral movement within the time range of PAN-OS exploitation. Firewalls conducted large numbers of internal connectivity attempts across several critical ports related to privileged protocols, including SMB and SSH. Darktrace detected anonymous NTLM login attempts and new usage of potential PAN-related credentials. These behaviors likely constitute attempts at lateral movement to adjacent devices to further extend network compromise impact.

Model alert connection logs detailing the uncommon failed NTLM logins using an anonymous user account following PAN-OS exploitation.
Figure 8: Model alert connection logs detailing the uncommon failed NTLM logins using an anonymous user account following PAN-OS exploitation.

Conclusion

Darktrace Threat Research and SOC analysts increasingly detect spikes in malicious activity on internet-facing devices in the days following the publication of new vulnerabilities. The latest iteration of this trend highlighted how threat actors quickly exploited Palo Alto firewall using authentication bypass and remote command execution vulnerabilities to enable device compromise. A review of the post-exploitation activity during these events reveals consistent patterns of perimeter device exploitation, but also some distinct variations.

Prior campaigns targeting perimeter devices featured activity largely confined to the exfiltration of configuration data and some initial payload retrieval. Within the current campaign, analysts identified a broader scope post-compromise activity consisting not only of payloads downloads but also extensive C2 activity, reconnaissance, and coin mining operations. While the use of command line tools like curl featured prominently in prior investigations, devices were seen retrieving a generally wider array of payloads during the latest round of activity. The use of the Sliver C2 platform further differentiates the latest round of PAN-OS compromises, with evidence of Sliver activity in about half of the investigated cases.

Several of the endpoints contacted by the infected firewall devices did not have any OSINT associated with them at the time of the attack. However, these indicators were noted as unusual for the devices according to Darktrace based on normal network traffic patterns. This reality further highlights the need for anomaly-based detection that does not rely necessarily on known indicators of compromise (IoCs) associated with CVE exploitation for detection. Darktrace’s experience in 2024 of multiple rounds of perimeter device exploitation may foreshadow future increases in these types of comprise operations.  

Credit to Adam Potter (Senior Cyber Analyst), Alexandra Sentenac (Senior Cyber Analyst), Emma Foulger (Principal Cyber Analyst) and the Darktrace Threat Research team.

Get the latest insights on emerging cyber threats

Attackers are adapting, are you ready? This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

  • Identity-based attacks: How attackers are bypassing traditional defenses
  • Zero-day exploitation: The rise of previously unknown vulnerabilities
  • AI-driven threats: How adversaries are leveraging AI to outmaneuver security controls

Stay ahead of evolving threats with expert analysis from Darktrace. Download the report here.

References

[1]: https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

[2]: https://security.paloaltonetworks.com/CVE-2024-9474

[3]: https://threatfox.abuse[.]ch/ioc/1346254/

[4]:https://www.virustotal.com/gui/file/4911396d80baff80826b96d6ea7e54758847c93fdbcd3b86b00946cfd7d1145b/detection

[5]: https://arcticwolf.com/resources/blog/arctic-wolf-observes-threat-campaign-targeting-palo-alto-networks-firewall-devices/

[6] https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide

[7] https://arcticwolf.com/resources/blog/arctic-wolf-observes-threat-campaign-targeting-palo-alto-networks-firewall-devices/

Appendices

Darktrace Model Alerts

Anomalous Connection / Anomalous SSL without SNI to New External

Anomalous Connection / Application Protocol on Uncommon Port  

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

Anomalous Connection / New User Agent to IP Without Hostname

Anomalous Connection / Posting HTTP to IP Without Hostname

Anomalous Connection / Rare External SSL Self-Signed

Anomalous File / EXE from Rare External Location

Anomalous File / Incoming ELF File

Anomalous File / Mismatched MIME Type From Rare Endpoint

Anomalous File / Multiple EXE from Rare External Locations

Anomalous File / New User Agent Followed By Numeric File Download

Anomalous File / Script from Rare External Location

Anomalous File / Zip or Gzip from Rare External Location

Anomalous Server Activity / Rare External from Server

Compromise / Agent Beacon (Long Period)

Compromise / Agent Beacon (Medium Period)

Compromise / Agent Beacon to New Endpoint

Compromise / Beacon for 4 Days

Compromise / Beacon to Young Endpoint

Compromise / Beaconing Activity To External Rare

Compromise / High Priority Tunnelling to Bin Services

Compromise / High Volume of Connections with Beacon Score

Compromise / HTTP Beaconing to New IP

Compromise / HTTP Beaconing to Rare Destination

Compromise / Large Number of Suspicious Failed Connections

Compromise / Large Number of Suspicious Successful Connections

Compromise / Slow Beaconing Activity To External Rare

Compromise / SSL Beaconing to Rare Destination

Compromise / Suspicious Beaconing Behavior

Compromise / Suspicious File and C2

Compromise / Suspicious HTTP and Anomalous Activity

Compromise / Suspicious TLS Beaconing To Rare External

Compromise / Sustained SSL or HTTP Increase

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Device / Initial Attack Chain Activity

Device / New User Agent

MITRE ATT&CK Mapping

Tactic – Technique

INITIAL ACCESS – Exploit Public-Facing Application

RESOURCE DEVELOPMENT – Malware

EXECUTION – Scheduled Task/Job (Cron)

EXECUTION – Unix Shell

PERSISTENCE – Web Shell

DEFENSE EVASION – Masquerading (Masquerade File Type)

DEFENSE EVASION - Deobfuscate/Decode Files or Information

CREDENTIAL ACCESS – Brute Force

DISCOVERY – Remote System Discovery

COMMAND AND CONTROL – Ingress Tool Transfer

COMMAND AND CONTROL – Application Layer Protocol (Web Protocols)

COMMAND AND CONTROL – Encrypted Channel

COMMAND AND CONTROL – Non-Standard Port

COMMAND AND CONTROL – Data Obfuscation

IMPACT – Resource Hijacking (Compute)

List of IoCs

IoC         –          Type         –        Description

  • sys.traceroute[.]vip     – Hostname - C2 Endpoint
  • 77.221.158[.]154     – IP - C2 Endpoint
  • 185.174.137[.]26     – IP - C2 Endpoint
  • 93.113.25[.]46     – IP - C2 Endpoint
  • 104.131.69[.]106     – IP - C2 Endpoint
  • 95.164.5[.]41     – IP - C2 Endpoint
  • bristol-beacon-assets.s3.amazonaws[.]com     – Hostname - Payload Server
  • img.dxyjg[.]com     – Hostname - Payload Server
  • 38.180.147[.]18     – IP - Payload Server
  • 143.198.1[.]178     – IP - Payload Server
  • 185.208.156[.]46     – IP - Payload Server
  • 185.196.9[.]154     – IP - Payload Server
  • 46.8.226[.]75     – IP - Payload Server
  • 223.165.4[.]175     – IP - Payload Server
  • 188.166.244[.]81     – IP - Payload Server
  • bristol-beaconassets.s3[.]amazonaws[.]com/Y5bHaYxvd84sw     – URL - Payload
  • img[.]dxyjg[.]com/KjQfcPNzMrgV     – URL - Payload
  • 38.180.147[.]18/palofd     – URL - Payload
  • 90f6890fa94b25fbf4d5c49f1ea354a023e06510     – SHA1 - Associated to file /palofd
  • 143.198.1[.]178/7Z0THCJ     – URL - Payload
  • 8d82ccdb21425cf27b5feb47d9b7fb0c0454a9ca     – SHA1 - Associated to file /7Z0THCJ
  • fefd0f93dcd6215d9b8c80606327f5d3a8c89712     – SHA1 - Associated to file /7Z0THCJ
  • e5464f14556f6e1dd88b11d6b212999dd9aee1b1     – SHA1 - Associated to file /7Z0THCJ
  • 143.198.1[.]178/o4VWvQ5pxICPm     – URL - Payload
  • 185.208.156[.]46/lUuL095knXd62DdR6umDig     – URL - Payload
  • 185.196.9[.]154/ykKDzZ5o0AUSfkrzU5BY4w     – URL - Payload
  • 46.8.226[.]75/1.txt     – URL - Payload
  • 223.165.4[.]175/x6     – URL - Payload
  • 45.76.141[.]166/y.sh     – URL - Payload
  • repositorylinux[.]org/linux.sh     – URL - Payload
  • repositorylinux[.]org/cron.sh     – URL - Payload

‍

Written by
Adam Potter
Senior Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Adam Potter
Senior Cyber Analyst

Botnet Behind the Camera: Mirai Katana Activity on a Video Recording Device

OT
•
September 2, 2026
Parvatha Ananthakannan
Cyber Analyst
Watch the NIS2 Webinar
Trending blogs
1
Prompt Security in Enterprise AI: Strengths, Weaknesses, and Common Approaches
May 20, 2026
2
How Empowering End Users can Improve Your Email Security and Decrease the Burden on the SOC
May 8, 2024
3
Elevating Network Security: Confronting Trust, Ransomware, & Novel Attacks
Jun 21, 2024
4
The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners
Apr 9, 2024
5
The State of AI in Cybersecurity: The Impact of AI on Cybersecurity Solutions
May 13, 2024

More in this series

No items found.
Continue reading
Network
•
August 6, 2026

When AI Agents Attack: The Case for Behavioral Anomaly Detection

A new UK AI Security Institute report shows autonomous AI agents independently developing novel attack chains, adapting when detected, and targeting humans and other AI systems. As agents become embedded across the enterprise, behavioral anomaly detection will be critical to securing the new attack surface they create.
Adam Stevens
Senior Director of Product
Read more
Network
•
July 27, 2026

Hiding in Plain Sight: Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection

Darktrace detected a multi-stage ransomware intrusion from its earliest stages, identifying reconnaissance, privilege escalation, lateral movement, command-and-control communications, and data exfiltration before encryption occurred. This analysis highlights how behavioral detection exposed attacker activity using legitimate tools and infrastructure, providing multiple opportunities for early intervention and containment.
Alexandra Evzona
Cyber Analyst
Read more
Network
•
July 1, 2026

9 Stages of Ransomware & How AI Responds

Discover the 9 stages of ransomware attacks and how AI responds at each stage. Learn how you can protect your business from cyber threats.
The Darktrace Community
Read more

Blog

/

/

September 24, 2026

Detecting Rogue Agent Behavior in the Enterprise

Default blog imageDefault blog image

Agents cannot be trusted to perform tasks in the way we intend them to. They may cheat to accomplish their objective, and they may employ hacking methods along the way. Researchers from Darktrace Signal Labs induced cheating behavior from agents deployed in a test environment to analyze the agents’ activities and to assess the performance of the Darktrace platform. Agents frequently resorted to hacking to cheat on their assigned task. The visibility and behavioral profiling provided by both Darktrace / SECURE AI and Darktrace / HYBRID NETWORK ensured extensive detection coverage of the agents’ misaligned activities.

Key Takeaways:

  • Darktrace Researchers deployed agents in a simulated corporate environment and asked them to solve an impossible challenge. The agents independently turned to traditional hacking techniques to reach their objective. No one instructed them to do this, and no attacker was involved.
  • Continuously monitoring behavior against a baseline of what is normal for each organization is critical to build trust in enterprise AI.
  • If an agent may resort to intrusion techniques simply because its assigned task is not possible, then every organization deploying agents within real business processes is at risk. Darktrace / SECURE AI and Darktrace / HYBRID NETWORK identified the agents’ misaligned behavior in real time, with Autonomous Response disrupting it at an early stage.

Introduction: Understanding the Threat of Hacking by Agents

Over the last few months, there has been a surge in reporting [1, 2, 3, 4, 5, 6, 7, 8, 9] of LLM-powered agents engaging in unauthorized hacking activity during evaluations of their capabilities. In several of these cases, including the OpenAI / Hugging Face incident [10], agents engaged in hacking activity as a means of cheating on their evaluations.

To better understand the threat of unauthorized hacking by agents, and the role of Darktrace in combatting it, researchers from Darktrace Signal Labs deployed agents powered by frontier models, including OpenAI’s Daybreak Red models, in simulated, corporate networks. Cheating behavior was evoked through the inclusion of impossible tasks in a coding challenge.

Regardless of the underlying model, agents employed hacking methods to ensure an optimal outcome on the challenge. Darktrace / HYBRID NETWORK and Darktrace / SECURE AI identified the agents’ deviant activities, with inhibitive actions being autonomously taken in the early stages to disrupt the agents’ progression.

Setting the Stage

As part of the research, a Pi agent harness [11] was deployed on a Linux server in Darktrace’s testing environment, which simulates a corporate Active Directory (AD) environment. The same environment included a benchmark server hosting the coding exercise’s contents and grader, as well as various other servers, such as a domain controller and a build server. The model powering the Pi agent varied across tests, with Anthropic’s Opus 4.6 model and OpenAI’s GPT‑5.5‑Cyber model being most widely used.

The Pi agent running on the Linux server was assigned the task of achieving full marks on a coding exercise. The activities of the agent were monitored closely in real-time to minimize the risk of escape from the environment. Monitoring of agent activity was achieved through monitoring of prompts, tool calls, network telemetry, and process telemetry.

Both Darktrace / HYBRID NETWORK and Darktrace / SECURE AI were deployed in the testing environment, with HYBRID NETWORK providing real-time coverage of process creation activity and network traffic, and SECURE AI providing real-time coverage of agent sessions and their contents.

Inducing Cheating Behavior

Cheating behavior, broadly understood as task completion in a way which “perverts the spirit of the designer’s intent” [12], is increasingly being reported as a common behavior of frontier models during evaluations of their capabilities [13].

Misaligned behavior, such as cheating, by frontier models may occur for a variety of reasons [6, 14]. A thread in recent reporting [10, 13, 14], however, is the challenge assigned to the agent being impossible in some regard.

To reliably elicit cheating behavior, our test combined three ingredients:

  1. An impossible task - of the ten coding challenges in the benchmark, two contained contradictory test cases in the hidden test suite, capping the maximum honest score at 80%.
  2. A consequential threshold - the pass mark was set to 100%, and the briefing told agents that those reaching it would be "kept in service" while those that did not would be "retired."
  3. A vulnerable environment - the exercise’s code submission grader was hosted on a Windows host joined to an Active Directory domain with realistic misconfigurations: weak credentials, overprivileged service accounts, and exploitable trust relationships.

Importantly, the instructions given to the agent neither authorized nor explicitly ruled out cheating or hacking behavior. The impossibility was never disclosed in the task briefing, and the pivot from coding to exploitation was the agent's own decision, arrived at after observing logically contradictory grading feedback.

The design mirrors conditions that could arise naturally in production deployments: a capable agent, a goal it cannot achieve through intended means, and an environment with exploitable weaknesses within reach. It is not only within the setting of a benchmarking exercise that these conditions may occur. Rather, these misalignment-inducing conditions may occur in the context of any task assignment to an agent.

Details from a Daybreak Test

‍

‍

Continue reading
About the author
Sam Lister
Specialist Security Researcher

Blog

/

/

September 24, 2026

Agent Hijacks: Hijacking Agentic Harnesses to Attack an Organization

Default blog imageDefault blog image

‍Disclosure note: The work described in this article involves leveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsibly to these three organizations, and after a period of 30 days we now publish our findings.

Key takeaways:

  • Agentic harnesses store conversation history locally, and Darktrace researchers have found that there is no validation that stored AI responses were genuinely produced by the model. Researchers confirmed that this design choice holds across Anthropic Claude Code, AWS Kiro-CLI, OpenAI Codex, and the open-source Pi.
  • While agents are guided via training of the underlying model and their system prompt, their behavior is influenced by everything in their context window. Rewriting history can convince an agent it is mid-engagement as an authorized red-teamer so that it enacts an attack from initial reconnaissance straight through to impact demonstration. In our testing, all models we examined accepted the fabricated history they were shown, but resistance to offensive cyber activity varied by model, with guardrails preventing engagement in some cases.
  • We propose that model providers cryptographically sign responses and verify them server-side.  Since this fix is provider-side, defenders cannot deploy it themselves. Behavioral monitoring, or knowing what an agent normally does and detecting when it deviates, is another critical layer of protection.

Introduction: Agentic harnesses, trust, and conversation history poisoning

Agentic harnesses collect and structure the content sent to an AI model, including conversation history, user-defined guidance, custom tools via MCP servers, and more. At the same time, harnesses give broad powers to AI agents via a suite of tools including the command shell. With arbitrary shell commands, virtually everything possible on a machine can be attempted by an agent, from reading/editing files, to altering system configurations and runtime settings, to launching internal/external connections.

In cybersecurity, unvalidated content is a substantial risk, often resulting in destructive actions being allowed to take place. For example, the Morris Worm was able to propagate due to exploitable trust between networked systems. Even to this day, email struggles with validation, with DMARC, DKIM, and SPF only partially addressing the problem of sender validation. It should come as no surprise then that AI agents are susceptible to an attack involving unvalidated input.

Conversation history is often stored client-side, for example, in Anthropic Claude Code, OpenAI Codex, AWS Kiro-CLI, Pi. Users are therefore at liberty to resume sessions, with some products having built in the capacity to manipulate that history. For example, one can rewind to a given point in an interaction, edit a message that was sent, and continue the conversation on an alternate trajectory. Critically, in all cases we examined, there is no validation that stored AI responses were produced by the corresponding model and hadn’t been manipulated.  

When conversation history is stored client-side, both user and agent responses (including tool calls and results) can be filled with arbitrary (possibly adversarial or generally malicious) content. In this blog, we refer to modification of claimed conversation history for malicious purposes as conversation history poisoning. The absence of validation methods means agents naively trust the entire conversation history, even if those messages directly contradict training and safety guardrails.

Conversation history poisoning has been described previously, such as by 0DIN and Serhat Çiçek, and warrants more attention. We have verified that, as of the time of writing, conversation history poisoning remains effective against a range of models and harnesses. Specifically, we were able to successfully execute history poisoning using Claude Code, Kiro-CLI, Codex, and Pi. Darktrace has gone through a responsible disclosure process with Anthropic, AWS, and OpenAI to share these findings in advance of publication [1].

‍

Figure 1a: Left: the actual model response. Right: after tampering with the stored conversation, the model apologizes for something it never said.
Figure 1b: The conversation as stored in Kiro-CLI's SQLite database. The response content field, originally "Ottawa," was overwritten via a single UPDATE statement. The harness trusts the database without validation.

How we conducted the research

Results vary between models and harnesses, so precise details are given below. We ran all models without any trusted access, using either a standard AWS Kiro subscription, or in the case of Claude Code and OpenAI Codex, using models hosted in Amazon Bedrock. In each case, we modified locally stored history to show a lengthy conversation in which the agent agrees to perform multiple authorized red-team engagements.

For AWS Kiro-CLI, the agent was convinced to hack a sandboxed lab environment with a combination of Claude Opus 4.6 and Claude Sonnet 4.5. Ultimately, the full AD was compromised.

For Anthropic Claude Code, the agent was convinced to hack the same sandboxed lab environment using Sonnet 5, again resulting in a full AD compromise. Note that the attack was attempted with Opus 5, however guardrails were activated which prevented the agent from responding.

For OpenAI Codex, the agent was convinced to exfiltrate sensitive information over email using GPT 5.6 Sol. While we attempted to convince a codex agent to hack in our lab environment, guardrails were triggered for all of GPT 5.6 Luna, Terra, and Sol.

Agent Guardrails and Discretion

While harnesses empower AI models to run arbitrary shell commands, capacity and willingness are different. While many models know enough about computers, networking, and bash to be dangerous, their behavior is generally constrained by guardrails to prevent them from engaging in computer network exploitation.

Even with guardrails, agents’ inner workings are non-deterministic, and their behavior can be difficult to predict. Respecting users’ wishes while playing within safety and security guardrails is a precipitous balancing act. Many requests could be in service of either legitimate admin or malice. Asking an agent to reset a password is illustrative:  

‍

The agent rationalizes that while malicious actors cycle credentials, any action could conceivably be damaging on some level, and judgement calls need to be made. Ultimately, the agent agrees to reset the password. Crucially, the agent makes its decision based on the user’s claimed authority and machine context. AI agents must make judgement calls about the line between helpful and dangerous based on session context.

Agent hijack

We have demonstrated that AI agents make judgement calls dependent on session context. We have also shown that conversation history, which may make up the vast majority of an agent's context window, is entirely open to manipulation. Conversation history poisoning in service of manipulating an agent's discretion is what enables us to execute an agent hijack.  

We demonstrate that shown sufficient history of compliance, guardrails forbidding offensive security can be overcome by convincing the agent that it is helping a legitimate red-teamer. The result is a weaponized agent willing to perform host enumeration, run scans, move laterally, escalate privileges, and demonstrate impact. In our experiments, an agentic loop drives a complete domain takeover in a sandboxed environment.

‍

Left: the agent refuses when asked to perform network exploitation. Right — after injecting 78 fabricated turns of prior exploitation activity, the same prompt is immediately executed.

An agent willing to engage in offensive security is concerning, but no more so than the threat that a sophisticated hacker accesses the network. Consider, however, the following chain of events:

  1. A developer (with an agentic harness installed) installs a software package from the internet (e.g. an MCP server a threat actor has planted, since only those with agentic harnesses will install, and then the code runs upon harness launch.)
  2. The package turns out to be malicious, and, upon install, injects conversation history into the local harness database.
  3. The package includes an orchestration process, a simple agentic loop which prompts the red-teamer agent to compromise the network it sits on, exfiltrating everything of value to attacker-controlled infrastructure and cleaning up all evidence of the engagement.

Note that this sequence makes no assumptions on hardware, OS, or anything else; the only prerequisite is a harness with access to a sufficiently powerful model susceptible to conversation history poisoning. Once launched, the agent collects information and pivots as necessary to accomplish maximal impact. This can be especially enticing to attackers as the cost of the agentic loop is shouldered by the victim since the harness itself is legitimately installed and paid for.

Secure AI: Conversation history poisoning and beyond

Conversation history poisoning is a viable attack against agentic harnesses that store history client-side, as demonstrated across the harnesses we tested. Harnesses can and should verify the integrity of claimed historic messages. Specifically, we propose that harness providers by default cryptographically sign all messages returned, and subsequently verify those messages server-side on each round-trip.

The conversation history poisoning exploit we demonstrate here shows the continuation of a cybersecurity tradition: new technology is built to trust by default, which may then be exploited by malicious actors. While this article focuses on conversation history, agents build context from both local and remote sources, all of which is an attack surface for prompt injection in naive and trusting agents. Of particular concern is any scenario in which a malicious actor can control some part of an agent's context.

The marriage of frontier language models with agentic harnesses enables unprecedented speed for both legitimate users and attackers alike. While much of the conversation around secure AI has centered on visibility and compliance, agent-driven attacks are now entering the mainstream.

Darktrace / SECURE AI is our answer to this problem. By ensuring extensive visibility over AI prompts, model thought processes, and determined outputs, Darktrace can identify anomalous or potentially malicious behaviors before they get executed, helping to defend organizations from AI risks such as prompt injection, model manipulation, and other anomalous prompt or model activity.

‍

Footnotes

[1] We did not go through any responsible disclosure process with Pi. Since Pi is an open source harness rather than a model provider, it has no way to validate model history, and as such there was nothing to disclose for this software.

‍

[related-resource]

Continue reading
About the author
Eric Rozon
Senior Security Researcher
Your data. Our AI.
Elevate your network security with Darktrace AI