> Plenty of apps run Terminal commands in the background

Most notably agents like Claude Code and Codex? Easy to check if you ask it to run:

    $ curl 'https://dv-g3b-emudhra.we-have-a-problem.com/'

    Your client successfully connected to the site. That's bad!