In the wild
Realized harm
FRUITSHELL: PowerShell reverse shell carrying hard-coded prompts to defeat LLM-powered security analysis
AIR-2025-0168 AIR record · 2025-11-gtig-fruitshell
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Notably, this code family contains hard-coded prompts meant to bypass detection or analysis by LLM-powered security systems.cloud.google.com
The record
Disclosed
2025-11-05
Occurred
2025
Vendor
various
Product
LLM-based security analysis tooling
Risk domain
Governance › Policy drift
System type
Generative model
Who acted
AI was the target (contested) — hard-coded prompts aimed at defeating the defender's LLM triage
Attack surface
Other
Autonomy level
Assistant
Initial vector
Publicly available reverse shell
Impact type
Evasion
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Unspecified; observed in operations
Capability abused
Taxonomy & references
Curator notes
First in-the-wild family GTIG names that targets the defender's AI rather than using AI offensively - prompt injection aimed at LLM triage pipelines. GTIG does not say whether the evasion actually worked against any specific product.
Supporting sources
Cite as
Enkrypt AI. "FRUITSHELL: PowerShell reverse shell carrying hard-coded prompts to defeat LLM-powered security analysis". AIR, AIR-2025-0168. https://agentincident.vercel.app/i/AIR-2025-0168/ (accessed 2026-10-19).