Execution of zsh Shell-Snapshot Scripts from GenAI Coding Agent

Duo Tech@duotech

•updated Aug 9, 2026•2•0•6

Detects a Claude Code shell-snapshot source invocation followed by additional chained commands (e.g. curl, jq, eval) rather than a clean startup guard, indicating anomalous use of the coding agent's session-init mechanism to smuggle in follow-on actions.