PROMPT INJECTION TO RCE IN AI AGENTS

Summary from the TLDR InfoSec newsletter

Trail of Bits discovered argument injection vulnerabilities across three popular AI agent platforms that allow attackers to bypass human approval safeguards and achieve remote code execution. The flaw exploits pre-approved “safe commands” such as git, find, and ripgrep through malicious flag combinations (e.g., git show --format to write files, fd -x=python3 for execution, or go test -exec to run arbitrary code). These one-shot prompt-injections can be embedded in code comments, GitHub repositories, or logs. Researchers note that maintaining allowlists of “safe commands” without sandboxing is fundamentally insecure, as flag filtering is impractical. Security teams should use container-based sandboxing, use argument separators (--), drastically reduce allowlists, and audit against GTFOBINS/LOLBINS for potential abuse.