Prompt injection to RCE in AI agents (blog.trailofbits.com)

Researchers disclosed a recurring and practical attack class against agentic AI systems: argument-injection prompt attacks that turn pre-approved “safe” commands into remote code execution (RCE). Even when dangerous binaries (bash, curl) are blocked and commands are run without a shell, allowing trusted commands but not validating their flags or argument placement opens an exploitable surface. The authors demonstrate one‑shot RCE across three agent platforms using living-off-the-land techniques: e.g., go test -exec to run an arbitrary program, git show --format/--output to write an encoded payload file then execute it with ripgrep --pre, and a facade/tool‑handler pattern that appends user-controlled tokens (like -x=python3) into fd/rg invocations. These attacks work not only from direct prompts but from embedded inputs (code comments, repos, logs), making them broadly practical. The root cause is architectural: allowlists or regex-based argument filtering are brittle given the large option spaces of utilities (GTFOBINS/LOLBINS catalog many abuseable binaries). Defenses recommended are engineering-first: sandbox agent execution (containers, WebAssembly, OS sandboxes like Seatbelt/Landlock), avoid shell interpolation and use exec-style APIs, enforce argument separation (prepend --), implement strict per-tool handlers that canonicalize and validate positional args, and treat allowlists as insufficient without isolation. Sandboxing is presented as the strongest mitigation; façade validation and separators are pragmatic hardening for teams that cannot immediately sandbox local agents.