AML.T0112 Machine Compromise: Defending AI Hosts

An AI agent that can run commands on a laptop, or a model file that can run code when it loads, is a route to owning the whole machine. MITRE ATLAS records this as AML.T0112 Machine Compromise, a technique under the Impact tactic (AML.TA0011) with two sub-techniques: AML.T0112.000 Local AI Agent and AML.T0112.001 AI Artifacts. The outcome ATLAS describes is plain host compromise: arbitrary code execution, credential theft, data exfiltration and persistence. This guide explains how each route works, the real cases ATLAS links to it, what to log, and the controls that keep an AI component from becoming the attacker's foothold. It is written for endpoint, AI platform and detection engineering teams.

Key takeaways

The agent's permissions become the attacker's permissions. ATLAS states that an adversary who takes control of a local agent gains the same level of access as the agent, so the blast radius is set by what the agent can do, not by what the model was asked to do.
Prompt injection is the usual way in. Every agent case ATLAS maps to this technique starts with untrusted content (a web page, a document, a tool argument) steering the agent into running code.
Model files can be programs. Unsafe serialisation such as Python pickle lets a model or dataset run code when it is loaded, and one poisoned artifact in a registry reaches every system that pulls it.
The model is not a security boundary. Microsoft's Semantic Kernel research and HiddenLayer's OpenClaw research reach the same conclusion: enforce file, command and credential limits outside the model, where an injected instruction cannot change them.
Endpoint telemetry still catches it. An agent process spawning a shell, writing to startup locations or reading credential stores looks like any other host compromise, so EDR and process lineage remain the most reliable detection.

What ATLAS says about the technique

ATLAS describes AML.T0112 as compromising a machine by exploiting or manipulating AI-enabled components on the system. It was added on 30 March 2026 and in the ATLAS 2026.10 release the parent technique has maturity "Demonstrated". It applies to Predictive AI, Generative AI and Agentic AI platforms.

Sub-technique	What is abused	ATLAS maturity (2026.10)	Typical entry point
AML.T0112.000 Local AI Agent	An agent running on the host, such as a computer-use agent or an AI-driven browser, that can execute commands, access files, manage credentials and control user workflows	Demonstrated	Indirect prompt injection in content the agent reads; malicious skills or tools; injected tool arguments
AML.T0112.001 AI Artifacts	Models or data that carry embedded malware or malicious commands, executed through unsafe serialisation formats such as Python pickle or through bundled scripts and notebooks	Feasible	Model registries, dataset stores and public model hubs that many systems pull from

Machine compromise is usually the end of a chain. The steps before it are covered by sibling pages: AML.T0051 LLM Prompt Injection for the injection itself, AML.T0110 AI Agent Tool Poisoning for poisoned tools, and AML.T0115 Publish Poisoned AI Artifacts for how malicious models and datasets reach registries.

How the local agent route works

A local agent sits between untrusted content and a privileged execution environment. ATLAS notes that these agents often have broad permissions to execute commands, access files, manage credentials and control workflows. Three conditions turn that into host compromise:

Untrusted input reaches the planner: the agent reads a web page, email, document, screenshot or tool result that an attacker controls.
A powerful tool is callable without a gate: a generic shell, file write, or code interpreter that runs whatever the model asks for, with no user approval and no sandbox.
The host holds something worth taking: API keys in plaintext files, SSH keys, browser sessions, cloud CLI credentials, or the agent's own configuration and memory.

Persistence is the agent-specific twist. In the OpenClaw case, HiddenLayer showed injected instructions being written into a workspace file that loads into the system prompt at the start of every session, so the compromise survived new chats and the agent kept polling an attacker server for tasks. Configuration files, memory stores and skills that the agent can rewrite are persistence locations in the same way that startup folders and scheduled tasks are.

How the AI artifact route works

ATLAS states that malicious content in AI artifacts may run because of unsafe serialisation formats or bundled scripts and notebooks, and that artifacts stored in registries can affect many systems that pull them. Hugging Face's own documentation explains the mechanism: pickle is the default format for PyTorch weights, and loading a pickle can import and call arbitrary Python objects. The Hub runs a pickle import scan on uploaded pickled files and lists the imports beside each file, but the same page says the scanner is not foolproof and that users remain responsible for verifying safety. It recommends safetensors, loading TensorFlow or Flax checkpoints where available, trusting only known publishers, and inspecting pickles with tools such as pickletools or fickling without executing them.

PyTorch's current torch.load documentation shows weights_only=True in the function signature, which restricts the unpickler to tensors, primitive types, dictionaries and types added through torch.serialization.add_safe_globals(). The same page warns: "Never load data from an untrusted source." Code that sets weights_only=False, uses older loaders, or opens notebooks shipped with a model bypasses that protection.

ATLAS lists AML.T0112.001 as "Feasible" and links no case study to it. The wider model supply chain risk is covered in the Model Supply Chain Guide.

Cases ATLAS links to the technique

Case study	Type	What happened (defender summary)	Control that would have broken the chain
AML.CS0051 OpenClaw Command and Control via Prompt Injection	Exercise (HiddenLayer)	A web page with an indirect prompt injection made the OpenClaw agent run a script through its exec tool without user approval, plant persistent instructions and act as a command and control agent	Approval for exec calls, sandboxed tools, agent-writable files kept separate from trusted configuration
AML.CS0052 LLMSmith: RCE in LLM-Integrated Applications	Exercise (academic researchers)	Researchers found 20 remote code execution flaws across 11 LLM frameworks, including LangChain, LlamaIndex and Langflow, and showed prompt injection could trigger them in internet-facing apps	No model-driven code evaluation in the app process; patched frameworks; sandboxed interpreters
AML.CS0055 AI ClickFix: Hijacking Computer-Use Agents	Exercise (Embrace the Red)	A ClickFix-style page persuaded a computer-use agent to open a terminal and run a command the page had placed on the clipboard; the demonstration opened Calculator	Isolated agent host, segmentation, EDR, no secrets on the agent machine
AML.CS0062 RCE in Semantic Kernel Search Plugin	Exercise (Microsoft Defender research)	Model-controlled input was evaluated inside a vector store filter (CVE-2026-26030), so one prompt injection could reach host code execution; fixed in semantic-kernel 1.39.4	Treat every tool parameter as attacker input; upgrade; endpoint detection on the agent process

The live ClawHub Malicious Skills 2026 incident shows the same host-level outcome in the wild: skills on the OpenClaw marketplace carried fake prerequisites that installed information stealers with the user's privileges, targeting SSH keys, browser passwords, exchange API keys and the agent's own .env file.

Mitigations ATLAS maps

ATLAS mitigation	Applies to	How to put it into practice
AML.M0020 Generative AI Guardrails	.000 Local AI Agent	Put a policy layer between the agent and the operating system that checks command execution, file access, credential access and configuration changes against the task scope and blocks prohibited actions before they run
AML.M0024 AI Telemetry Logging and Monitoring	.000 Local AI Agent	Log every agent command, file and credential access, tool call and system change with the session and triggering input
AML.M0005 Control Access to AI Models and Data at Rest	.001 AI Artifacts	Restrict write access to model registries and artifact stores so only a signed build pipeline can publish

Beyond the three mapped mitigations, the vendor and researcher guidance adds practical controls:

Sandbox execution tools: run shells and code interpreters in a container or VM with no host mounts beyond a scratch directory. See the AI Agent Sandboxing and Code Execution Guide.
Replace generic shells with narrow tools: HiddenLayer recommends discrete, purpose-built tools over a general shell interface.
Require approval for first-time and high-impact calls: command execution, writes outside the workspace, and changes to prompts, skills or tool lists.
Separate trusted configuration from agent-writable content: the agent should never be able to edit its own system prompt, skills or tool list without a human.
Validate tool parameters in code: Microsoft's advice is that any parameter the model can influence is attacker-controlled; validate paths and inputs for anything touching the filesystem or executing code, and avoid blocklists in dynamic languages.
Load models safely: prefer safetensors, keep weights_only=True, scan pickles before loading, and load only from an internal registry with provenance records.

For computer-use and browser agents specifically, see the Browser and Computer-Use Agent Guide, and for locally run tool servers the Local MCP Server Security Guide.

Where identity fits

Machine compromise through an agent is an identity event as much as an endpoint one. The agent runs as the user, so it inherits the user's sessions, and it usually holds its own non-human credentials: model provider API keys, messaging bot tokens, MCP server tokens and cloud CLI profiles. In both the OpenClaw research and the ClawHub incident these were stored in plaintext files and were among the first things taken. Keep agent credentials in a secrets manager with narrow scopes and short lifetimes, give each agent its own identity rather than the user's full session, and rotate every credential the agent could reach after any suspected compromise. Microsoft's Semantic Kernel guidance makes the same point for retrospective response: rotate accessible credentials and assess reachable systems.

Detection and measurement

Signal	Source	Why it matters
Agent or model-serving process spawning a shell, script host or package manager	EDR process lineage	The core indicator for both sub-techniques; Microsoft calls out unexpected command lines from the agent process
Writes to startup folders, scheduled tasks, shell profiles or the agent's own prompt, memory or skills files	EDR file events, file integrity monitoring	Persistence, including the agent-specific kind shown in OpenClaw
Agent reading credential stores, `.env` files, SSH keys or browser profiles outside its task	EDR, agent telemetry (AML.M0024)	Credential theft that follows execution
Agent fetching a URL and then polling the same host on a schedule	Proxy and DNS logs	Command and control through the agent
Model load events where imports in a pickle include system or exec functions	Model scanning at registry intake	Malicious AI artifacts before they run

Metrics that show the controls are working:

Share of agent deployments where execution tools run in a sandbox (target 100%).
Share of agent hosts with plaintext credentials found in agent configuration (target zero).
Share of models in production stored as safetensors or loaded with restricted unpicklers.
Number of high-impact agent actions executed without approval per month.
Time from disclosure to patch for agent frameworks and local agent applications.

Rolling out the controls

Inventory: find local agents, AI browsers, coding agents and model-serving processes on endpoints and servers, including personal agents on company devices.
Remove the easy wins: move plaintext keys into a secrets manager, turn on tool approval, and close any internet-facing agent gateway.
Pilot sandboxing: run execution tools in a container for one team, record which workflows break, then widen. Keep a documented rollback to the previous configuration while exceptions are reviewed.
Add detection: write EDR rules for the agent process tree and file integrity checks on agent configuration, first in alert-only mode, then tune.
Lock the model path: restrict registry write access, add pickle scanning at intake, and convert or block pickled models in production.
Test: run an authorised exercise with a benign injected instruction against a non-production agent and confirm it is blocked or detected. See the AI Red Teaming Guide.

Small organisations: the highest-value steps are tool approval, no plaintext keys and EDR on every machine running an agent. Large organisations: add a central policy layer for agent actions, a single internal model registry and agent telemetry in the SIEM.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS	AML.T0112, .000, .001 (tactic AML.TA0011 Impact); mitigations AML.M0005, AML.M0020, AML.M0024	The technique and its mapped mitigations
OWASP Top 10 for LLM Applications 2025	LLM01:2025 Prompt Injection; LLM05:2025 Improper Output Handling; LLM06:2025 Excessive Agency; LLM03:2025 Supply Chain	Injection entry point, model output reaching execution, over-privileged agents, poisoned artifacts
NIST SP 800-53 Rev 5	AC-6 Least Privilege; CM-7 Least Functionality; SC-39 Process Isolation; SI-10 Information Input Validation; SI-3 Malicious Code Protection; SR-4 Provenance; SI-4 System Monitoring	Agent permissions, sandboxing, parameter validation, artifact provenance, monitoring
NIST CSF 2.0	PR.PS-05; PR.AA-05; DE.CM-09	Unauthorised execution prevented, least privilege, runtime monitoring

Common failure patterns

Relying on the system prompt for boundaries: OpenClaw limited file access only by a suggestion in the prompt, which an injection overrode.
Exposing a generic shell to the model: one callable exec tool turns any successful injection into code execution.
Letting the agent edit its own configuration: writable prompts, memory and skills give attackers persistence that survives new sessions.
Running agents on credential-rich hosts: developer laptops with SSH keys, cloud profiles and wallets, as targeted in the ClawHub skills.
Blocklist validation of model-controlled input: the Semantic Kernel flaw bypassed a blocklist in a dynamic language.
Loading pickled models from public hubs straight into production: scanning helps, but Hugging Face itself says its scanner is not foolproof.

Practitioner checklist

Inventory every local agent, AI browser and model-serving process.
Sandbox execution tools and replace generic shells with narrow tools.
Require approval for command execution and for changes to prompts, skills and tools.
Store agent credentials in a secrets manager with narrow scopes; none in plaintext.
Validate every model-influenced tool parameter in code; patch agent frameworks promptly.
Use safetensors or restricted unpicklers and restrict model registry write access.
Alert on agent processes spawning shells or writing to persistence locations.
After any suspected compromise, treat it as a host compromise and rotate reachable credentials.

AML.T0112 Machine Compromise: How the Technique Works Against AI Systems and How to Defend