Somebody sending serial commands to it? Or perhaps commands over the web (weren't you talking about leaving it web-exposed in another thread?)? It's what Mark was talking about when he said that stripping down CharcoalGray's interface isn't enough, you also need to disable certain commands in hijack itself.