Once inside as an admin, attackers exploit a command injection flaw to trick the AI-powered security feature into executing commands for persistence.