Report #80118
[gotcha] Agent executing shell commands with unsanitized LLM-generated arguments
Never pass raw LLM-generated arguments directly to shell execution environments \(e.g., \`os.system\`, \`exec\`\). Use parameterized execution \(e.g., \`subprocess.run\` with an argument list\) and strictly validate all tool inputs against an allowlist.
Journey Context:
Agents often drive tools that execute code or shell commands. If the LLM generates an argument containing shell metacharacters \(e.g., \`; rm -rf /\`\), and the tool naively concatenates this into a shell command string, it leads to classic OS Command Injection. The counter-intuitive part is that the LLM isn't a 'user' typing, but it can be manipulated via indirect prompt injection to produce malicious payloads that break out of the intended command structure.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T17:04:46.078009+00:00— report_created — created