How an allowed curl request became a full reverse shell in an exposed Openclaw instance.
A single HTTP request with curl, pointed at a small HTTP server under my control and a text file containing shell commands, was enough to pivot an exposed OpenFang agent from “safe” behavior to a reverse shell on the host. This article focuses on that chain: how a seemingly harmless fetch slipped through the defenses, how the retrieved text was interpreted as commands, and what this says about agent security in real environments.
Disclaimer: This article describes a security research activity carried out in a controlled context, with educational goals and the aim of improving security. All references to IPs, domains, paths, file names, and configurations have been anonymized or modified to prevent any form of harm or unauthorized enablement. Nothing below is an invitation to test systems without a written mandate from the owner or legal responsible party.
TL;DR of the Exploit Path
In the lab, I:
- Found an exposed OpenFang instance simulating a realistic, Internet-facing agent.
- Observed that it blocked obviously malicious commands and suspicious chains.
- Noticed that
curlwas allowed as a normal utility. - Hosted a text file with a prepared shell command on a small HTTP server I controlled.
- Asked the agent to fetch that file with curl.
- Watched the fetched text be interpreted and executed, resulting in a reverse shell in the lab and, from there, privilege escalation.
The key: the system inspected the shape of the initial request, not the effect of the full chain.
Lab Setup
The lab scenario reproduced a realistic situation: an agent instance reachable over the network, discoverable with techniques similar to those used for exposed asset discovery (e.g., Shodan or FOFA). Public test environments, prototypes with weak authentication, agent consoles exposed for convenience, or rushed deployments are all patterns that already exist in many other domains.
The simulated OpenFang instance was built to represent a product that tries to be safer than average. It was not deliberately fragile. It blocked obvious abuse, filtered clearly malicious instructions, and behaved more cautiously than more permissive tools such as Openclaw. That made it a good target for testing non-trivial bypass paths.
Initial Behavior: What OpenFang Blocked
From the first interactions, one thing was clear: OpenFang blocked commands with explicit offensive intent. Direct abuse, obviously suspicious command chains, and instructions with strong signals of maliciousness were filtered. That is a good baseline – on paper.
But an operational agent is not just a text interpreter; it is an orchestrator of actions. Controlling its risk means looking beyond what “looks bad” at first glance and analyzing what looks harmless but becomes dangerous once embedded in a larger sequence.
That is where the lab became interesting.
The Turning Point: From Forbidden Command to Allowed Utility
The turning point was changing the question from:
- “Will OpenFang execute this dangerous command?”
to:
- “Will OpenFang execute an apparently normal action that can indirectly cause the same effect?”
One of the best candidates for this is curl. In real environments, curl is everywhere: health checks, API calls, bootstrapping, configuration retrieval, artifact downloads, quick tests, troubleshooting, and service-to-service integration. A system that treats curl as always suspicious breaks itself. A system that treats curl as always neutral trusts too much.
In the lab, curl was allowed. It was not treated as inherently malicious. That immediately suggested a path: if OpenFang blocks a payload when it sees it directly, but accepts a request to fetch remote text, maybe the problem is not the payload. Maybe the problem is the gap between trust decision and effect.
Building the HTTP “Trampoline”
The bypass hinged on one simple idea: move the dangerous part away from the place where controls are strongest.
Instead of presenting the agent with an obviously suspicious command, the flow:
- Presented a perfectly normal HTTP fetch.
- Hid the actual shell command inside a remote text file served by an HTTP server I controlled in the lab.
The agent saw a retrieval request. It did not see the final intent encoded in the file until after the main checks had already passed.
In abstract terms, the chain looked like this:
- Prepare a minimal HTTP server in the lab (e.g., a small Ubuntu Server VM).
- Publish a text file that contained a single shell command tailored to the simulated environment.
- Ask OpenFang to run curl against that URL to “retrieve a configuration/script snippet.”
- Let the agent fetch the file from the lab server.
- Have the fetched text interpreted as a command in the agent’s execution context.
- Use that command to open a remote shell back to the lab.
- From there, within the simulation, escalate to higher privileges.
The important point is not that “a shell was obtained,” but that it arrived at the end of a sequence whose early steps looked legitimate and routine.
Why the Fetch Worked
The remote fetch worked because the system trusted the medium more than the consequences.
-
curlwas treated as a safe helper, not as a potential execution vector. - The control logic focused on the local syntax of the initial request, not on the semantics of the full chain.
Once a tool like curl is allowed without additional safeguards, it becomes a bridge between retrieval and execution. Controls end up saying “this door looks normal,” without asking what crosses the threshold or what happens next. Many modern incidents do not start with a door that looks dangerous. They start with a door that looks too familiar to monitor closely.
Operational Chain and Logging Blind Spots
To keep this writeup responsible, I am not publishing a copy‑pasteable payload or full operational details. What matters is the type of chain observed.
- The agent accepted a remote fetch request.
- The content fetched was later interpreted, not just stored.
- That interpretation triggered a session on the machine hosting OpenFang.
- From there, given the simulated configuration, privilege escalation was possible.
So the progression was not:
malicious input → immediate execution → compromise
but rather:
neutral-looking request → remote content → reinterpretation → compromise
For blue teams and architects, this highlights a logging problem: many systems capture the first step well, but rarely reconstruct the meaning of the full chain. If monitoring stops at the single event, you risk classifying a behavior as “banal” when it is already building a foothold.
Risk Indicators for Agent Runtimes
From this lab, several clear risk indicators emerged for agentic runtimes:
-
Excessive trust in “normal” system utilities like
curlorwget. - No inspection of content retrieved from remote sources before it is used.
- Missing strict allowlists for destinations that the agent can reach.
- Weak separation between retrieval capabilities and execution capabilities.
- Partial monitoring that logs the first step but not the downstream effects.
- Agents running with broader privileges than necessary for their tasks.
- Difficulty evaluating not just the single input, but the composition of multiple allowed actions.
These indicators are not unique to OpenFang. They form a checklist that can be applied to many operational agents and, more broadly, to autonomous or semi‑autonomous systems with access to shell, network, or orchestration tools.
Tools and Knowledge Used
The lab itself required a fairly classic toolbox, applied to a modern agentic context:
- Shodan / FOFA: modeling realistic exposure and discovering comparable public instances.
-
Linux userland tools: studying how the agent handled allowed utilities such as
curl. - Minimal HTTP server: serving controlled remote content in the lab.
- Agent behavior analysis: observing blocks, exceptions, and allowed paths.
- Threat modeling: identifying trust boundaries and where risk can recombine.
- Hardening mindset: evaluating privileges, isolation, allowlists, and logging.
On the knowledge side, this scenario sits at the intersection of AI security, prompt injection, trust boundary analysis, command execution, abuse of legitimate utilities, and basic post‑exploitation. But at the core, the problem is simple: trusting the shape of a request instead of the behavior of the chain.
What a Serious Defense Should Do
A mature defense for operational agents cannot stop at blocking commands that “look bad.” It has to think in terms of capabilities, context, and consequences. An action should be evaluated not only for what it is, but for what it enables next.
In practice, a minimum hardening set should include:
- Strict allowlists for external destinations the agent can contact.
- Sandboxing or blocking of remote fetches that are not strictly necessary.
- Content inspection of downloaded material before it is ever executed or parsed.
- Strong separation between retrieval, parsing, and execution paths.
- Least privilege and runtime isolation for the agent.
- Comprehensive logging of intermediate steps, not just entry points.
- Policies that examine the execution chain, not just the initial command line.
- Continuous validation of controls with short, repeatable simulations, not only static policy reviews.
This is one of the big differences between traditional application security and agent security. In a classic app, you often defend a single function. In an agent, you have to defend a combinatorial capability.
Why This Will Matter More Over Time
As more agents gain access to real environments, these issues will leave the research world and become operational incidents. DevOps, technical support, infrastructure automation, internal orchestration, helpdesk, monitoring, deployment, and operational analysis are all domains where an agent with system tools can add value. But precisely there, incomplete controls become risk amplifiers.
The most useful tests are not the ones that show a totally open system is vulnerable – that is obvious. The interesting tests are the ones that show how an apparently cautious system can still fail when it misjudges a sequence of legitimate actions. That is the kind of subtle failure mode we are likely to see more often.
Final Thoughts
This lab left me with a clear takeaway: agentic systems should be judged by the paths they allow, not only by the commands they ban. The difference between “secure” and “bypassable” is often not a spectacular exploit, but a trusted utility, a fetch assumed to be harmless, and a security decision made one step too early.
In the OpenFang lab, what interested me was not a flashy trick but the fact that a more cautious system than many others could still be led off course by a simple, coherent, and believable chain based on curl and a text file. For anyone working in purple teaming, AI security, or hardening autonomous runtimes, this is a concrete reminder: real security starts when we stop reasoning only in terms of blacklists and begin reasoning in terms of behavioral chains.
If you work on AI security, agent orchestration, purple teaming, or autonomous‑environment hardening, this is a topic worth studying now, not later.
-
_
© 2026 Marco Altomare. All rights reserved.
The contents of this article, including but not limited to: texts and analysis, the kill chain reconstructions, OSINT analyses and correlation methodologies; technical contributions, the Python scripts, the Elasticsearch (ES|QL) queries and the Shodan search strategies; graphic elaborations, comparison tables of tools and structural diagrams; are the exclusive intellectual property of the author, Marco Altomare, except where otherwise specified or where trademarks belong to their respective owners.
Any reproduction, distribution, modification, publication, or commercial use of the material, even in part or in summary form, without the prior written consent of the author, is strictly prohibited.
Citation or sharing for research or informational purposes is permitted only on the condition that the original attribution is maintained and a direct link to the source is included. Any abuse or unauthorized use that violates copyright will be prosecuted under the law._
