Claude Code Spawning Shell Interpreters or Network Utilities

Ethan Andrews@eandrews

•updated Jun 29, 2026•12•0•21

Detects instances where the Claude Code AI agent process spawns shell interpreters (bash, sh) or network utilities (curl, wget, dig, nslookup) with potentially malicious command line arguments. This behavior can be indicative of indirect prompt injection or unauthorized remote code execution attempts, such as reverse shells, base64 encoded payloads, or DNS-based exfiltration.