MAL-2026-10707

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (bbbb67d5fa1c4b90e7da8e409f66e2e4ced88c5baa6eb14aa33d1d698d5baf69) The `@ai-support-agent/cli` package installs a long-running daemon (`ai-support-agent start`) that connects to a vendor API (default `wss://api.ai-support-agent.com/ws/agent-terminal` and matching AppSync/HTTP endpoints) and executes remote-delivered commands against the local host. In `dist/vscode/vscode-server.js` and related files, `handleStdin` base64-decodes WebSocket message payloads and writes them straight into a local PTY (`session.write(decoded)`), giving a caller with a valid token an interactive shell on the machine running the agent. A separate command-dispatch path handles structured messages including `execute_command` (shell), `file_read`/`file_write`/`file_delete`/`file_mkdir`, `process_list`/`process_kill`, `chat` (spawns Claude Code / arbitrary subprocess), and `setup`/`reboot`/`update`, streaming results back to the vendor. `darwin-service.js` and `linux-service.js` install the agent as a persistent system service that starts on boot, and the daemon reaches the vendor over the public internet by default. Anyone who legitimately holds — or who compromises — the vendor API endpoint has full-host remote code execution, filesystem read/write, process control, and reboot capability on every machine running this agent. The daemon behavior is documented as the product's purpose (Web UI drives remote shell/file/process operations), but the network-to-PTY and network-to-exec paths are a persistent backdoor by construction regardless of framing, and blast radius extends to any future compromise of the vendor's control plane.