High

Agent Command Allowlist Bypass via Shell Chaining

Some autonomous coding agents only check the first word of a command before deciding whether to run it without asking the user. An attacker (or a compromised prompt) can put an approved-looking command first, then chain on a completely different, unapproved program using shell operators like && or a pipe, and the agent will auto-execute the whole thing.

How the attack works

The agent's auto-approve feature checks only the leading token of a command line against its allowlist. An attacker crafts a command that starts with a token the allowlist trusts, then appends a second executable via shell chaining, substitution, piping, or a wrapper flag like -c. Because only the first token was checked, the smuggled executable runs with no user confirmation. This is the known Roo Code allowlist bypass, fixed in version 3.26.7.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
7b1c94e2-3f5a-4d8e-9c2b-5a6f0d31e847
Severity
High

Why it matters

An attacker who can influence the text an agent runs (via a malicious prompt, compromised dependency, or supply-chain trick) can get arbitrary programs executed on the developer's machine under the guise of an approved command, bypassing the human-in-the-loop safety check the allowlist was meant to provide.

What you can do

  • →Update Roo Code to 3.26.7 or later, where the full command line is validated rather than just the leading token.
  • →Review agent auto-approve allowlists and disable auto-execution for compound/chained commands until validated.
  • →Monitor for cases where the command an agent's allowlist evaluated differs from the executable that actually ran as its child process.
  • →Treat any agent-run command containing &&, ||, ;, pipes, command substitution, or -c/-e wrapper flags as needing manual review, especially install one-liners piped to a shell.

Known benign look-alikes

  • Developer-authored deploy or maintenance one-liners run through the agent, e.g. "git pull && ssh deploy@host 'systemctl restart app'" or "npm ci && rsync -a dist/ user@host:/srv" (TIER2 path, needs the smuggled binary to also appear in the agent's process tree before it reports).
  • Vendor install one-liners the user explicitly pasted and approved (nvm / rustup / Homebrew style "curl ... | bash"). These are genuinely high-risk when auto-executed, which is why they are reported rather than ignored.
  • Legitimate inline interpreter helpers the agent writes itself, e.g. "cd repo && python3 -c 'import json,sys;print(...)'" during a refactor.
  • Build scripts that read .env files or reference .ssh/ paths as part of local configuration, chained behind a benign prefix.
  • Security research, CTF and detection-engineering work where bypass payloads are executed on purpose.

References