Axiom Post-Exploitation Persistence via Cron or SSH Keys Spawned by Claude Code

Ethan Andrews@eandrews

•updated Jun 29, 2026•1•0•9

Detects instances where the Claude Code AI agent or its subprocesses are used to establish persistence. This is achieved by monitoring for crontab modifications or direct writes to SSH authorized_keys files, which are common indicators of post-exploitation activity following an Axiom-style indirect prompt injection.