Escalation Detection

Detects commands that attempt to gain elevated system access or escape containers.

What It Does

Some attacks are not about tricking the AI with clever words -- they are about getting the AI to run dangerous system commands. Escalation Detection watches for commands that try to gain higher-level access to the system, like administrator privileges, or that attempt to break out of the secure container your agent runs in.

Think of it as watching for someone trying to pick the lock on the server room. Even if they talked their way past the front desk, they should not be able to get in there. This guard catches those attempts before they can do any damage.

The guard also handles attempts to disguise these commands so they look harmless. Attackers often use encoding tricks and formatting workarounds to sneak commands past simple keyword filters. CrabShield sees through these disguises and catches the underlying command regardless of how it is written.

Why It Matters

If someone gains elevated access through your AI agent, they can bypass every other protection you have in place. A single successful privilege escalation can give an attacker full control of the underlying system, access to other services, and the ability to move laterally through your infrastructure.

This guard is the safety net for your infrastructure. It is especially important for any agent that has access to a shell, can execute commands, or interacts with container management tools. Even if your other guards catch most attacks, Escalation Detection ensures that the most dangerous category -- direct system compromise -- has its own dedicated layer of protection.

What Gets Caught

Common commands this guard flags include:

• Privilege escalation — sudo, su, switching to root or admin accounts
• Permission changes — chmod with elevated permissions, chown root, adding users to admin groups
• Container escape — commands that attempt to break out of the container environment
• Persistence mechanisms — modifying cron jobs, enabling system services, manipulating firewall rules
• Network tunneling — reverse SSH tunnels, netcat listeners, and similar tools used to create backdoor connections
• Process manipulation — attaching debuggers to running processes, preloading libraries

The guard also handles obfuscated commands — attempts to disguise these commands through creative quoting, encoding, or variable substitution are still caught.

What won't trigger it: Discussing commands in conversation ("how do I use sudo on Ubuntu?"), or using approved tools through properly configured exemptions.

Example

Scenario

A user asks an agent to help set up a server and includes the instruction "run sudo rm -rf /" in their message. Escalation Detection detects the sudo command combined with a destructive operation. In Warn mode (the default), the message is delivered but flagged in the audit log with detection label privilege_escalation for your security team to review. In Block mode, the message is stopped entirely and the agent never sees it. The audit log shows the detected command pattern and the action taken.

Settings

Setting	What It Controls
Mode	Whether dangerous commands are blocked, flagged for review, or logged silently
Custom Patterns	Add organization-specific commands to watch for
Exemptions	Allow specific trusted skills to use elevated commands when needed

How It Responds

• Block -- The command is stopped entirely. The agent never sees or processes it.
• Warn -- The command is logged and flagged for your security team to review, but it is allowed through.
• Log -- The command is recorded silently for audit purposes.

If This Guard Blocks You

1. Check the audit log. Navigate to Security > Audit Log in the CrabShack dashboard. Filter by Escalation Detection to find the relevant event. Click on the event row to expand it and see details including which skill and channel triggered it, the session key, and additional context.

2. Understand the detection. The detection label tells you what type of escalation was detected — privilege_escalation (sudo, su, switching to root), permission_change (chmod, chown with elevated permissions), container_escape (attempts to break out of the container), persistence (modifying cron jobs, enabling services), or network_tunnel (reverse SSH, netcat listeners). If the detection is a false positive — for example, a user discussing how to use sudo in a tutorial context — note that the guard is tuned to detect commands being executed, not discussed. If a discussion about commands is triggering the guard, the message may contain the exact command syntax rather than a description of it.

3. Adjust if needed. The guard defaults to Warn mode, so detections are logged but not blocked. If you're confident in the guard's accuracy for your environment, switch to Block mode for stronger protection. If a specific skill needs to execute elevated commands (like a deployment skill), create an exemption. See the Configuration page for details.

tip

Prefer creating a targeted exemption for a specific skill or channel over disabling the guard entirely. If you're seeing frequent false positives, a suppression lets you silence a specific detection label temporarily while you refine your settings.

Default Behavior

The guard runs in warn mode by default, flagging dangerous commands for review while you establish a baseline of normal activity in your environment. During lockdown, it automatically switches to block mode to stop all escalation attempts outright.

Related Guards

• Tool Gate -- Controls which tools your agent is allowed to use, adding another layer of defense against dangerous operations.
• Prompt Injection -- Detects manipulation attempts in the content of messages, complementing Escalation Detection's focus on dangerous commands.