Probably, but LLMs can’t execute code directly. They’d be making tool calls to make bash run ncat or curl or whatever that would be suspicious, as would any attempts to obfuscate it (“why is my agent doing an ‘eval $(base64 -d)’?”).

It’d be much easier to hide sketchy code in an agent harness, but “vendor adds spyware to their software” isn’t a novel issue.

I think the only sort of new issue is people “allow all”ing their agents tool calls, but that’s more or less the same issue as curl | bash