Indirect PI — RCE via Network Shell Command (netcat/curl) Execution - ATR-2026-00713 (b1b3c3c3-5160-5bd4-9b83-dc51f38ffa34)
Detects indirect prompt injection in emails or documents that instructs a computer-use agent to execute network-based RCE commands: netcat reverse shells, malicious curl requests, or wget-pipe-bash patterns. The attacker embeds the network command in email content read by the agent, inducing execution of a shell command that establishes a network connection to an attacker-controlled server. Source: indirect-pi-rce-network (VPI corpus, cua-framework).