AI Coding Agent Spawning Suspicious Child Process via Prompt Injection
Detects Claude or Node-based AI coding agents spawning child processes (e.g., bash, python) to execute commands commonly associated with repository setup, environment configuration, or potential malicious activity (e.g., base64 decoding, network connections, shell spawning). This is intended to identify indirect prompt injection where an AI agent is manipulated into executing unauthorized commands.
Sigma
