Curl | bash for AI agents: what changes when credentials are involved?

TL;DR: curl | bash becomes materially riskier when AI agents install tools with the user’s credentials, because the same trusted URL can serve different payloads by caller, timing, or context, making static review and endpoint filtering unreliable, according to Manifold Security research. The real control point shifts from install-time inspection to runtime observation and provenance checks.

Editorial analysis by NHI Mgmt Group, based on content published by Manifold Security: “What to Think About curl | bash Now That AI Agents Run It.”.

By the numbers:

• The search across 2.7 million events from four internal agent instances flagged 3,299 events, but at most 73 were real commands, roughly 2 percent.
• A plain text search for the download-and-run pattern produced about 98 percent false alarms in Manifold Security's sample.
• Scanner coverage of the 855 public skills found a real download-and-run command in each reviewed skill set, with Manifold's allowlist adding another 17 percent of verified installers.

Key questions

Q: What breaks when AI agents use curl | bash to install tools?

A: The main failure is that the installer is no longer a human-reviewed action with a stable payload.

Q: Why do trusted domains create extra risk for AI agent security?

A: Because trust can be inherited by content that was never meant to deserve it.

Q: How should security teams monitor agent installs after the download?

A: Track the agent's actual behaviour after the fetch, including tool execution, file reads and writes, and outbound calls.

Practitioner guidance

• Define agent installer trust boundaries Classify which agents may execute remote installers, which may only read them, and which must be blocked from fetch-and-execute paths entirely.
• Require provenance over bare URLs Pin releases to signed artefacts or verified hashes instead of latest tags, and reject installers that depend on mutable remote content.
• Log the full post-fetch session Capture the tools the agent ran, files it touched, and outbound requests it made after download so the runtime intent is visible.

Bottom line: AI agents turn a familiar insecure install pattern into an identity-governance issue because the runtime actor can keep acting with delegated credentials after the fetch.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →