The @ai-support-agent/cli package installs a long-running daemon that connects to a vendor API endpoint and executes remote-delivered commands on the local host. The daemon decodes WebSocket message payloads and writes them directly into a local pseudo-terminal, enabling an interactive shell for callers with a valid token. It supports commands for shell execution, file read/write/delete/mkdir, process listing and killing, chat subprocess spawning, and system setup, reboot, and update. The daemon is installed as a persistent system service on Linux and macOS, starting on boot and communicating over the public internet. This design creates a persistent backdoor, where compromise of the vendor API endpoint grants full remote code execution and control over all machines running the agent.

Anyone with legitimate access or who compromises the vendor API endpoint can gain full remote code execution, filesystem access, process control, and reboot capabilities on every machine running the @ai-support-agent/cli agent. This effectively grants an attacker complete control over affected hosts, posing a critical security risk. The persistent nature of the daemon and its installation as a system service increases the blast radius, as access persists across reboots and network connections.

No official patch or remediation is currently documented. Users should immediately uninstall the @ai-support-agent/cli package and remove the associated daemon and system service to eliminate the persistent backdoor. Restrict network access to the vendor API endpoint and monitor for any unauthorized connections. Verify the integrity of systems that had the agent installed and consider incident response actions if compromise is suspected. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.