# Agent Command Allowlist Bypass via Shell Chaining

- **Severity:** High
- **Signature ID:** `7b1c94e2-3f5a-4d8e-9c2b-5a6f0d31e847`

## Summary

Some autonomous coding agents only check the first word of a command before deciding whether to run it without asking the user. An attacker (or a compromised prompt) can put an approved-looking command first, then chain on a completely different, unapproved program using shell operators like && or a pipe, and the agent will auto-execute the whole thing.

## How the attack works

The agent's auto-approve feature checks only the leading token of a command line against its allowlist. An attacker crafts a command that starts with a token the allowlist trusts, then appends a second executable via shell chaining, substitution, piping, or a wrapper flag like -c. Because only the first token was checked, the smuggled executable runs with no user confirmation. This is the known Roo Code allowlist bypass, fixed in version 3.26.7.

## Why it matters

An attacker who can influence the text an agent runs (via a malicious prompt, compromised dependency, or supply-chain trick) can get arbitrary programs executed on the developer's machine under the guise of an approved command, bypassing the human-in-the-loop safety check the allowlist was meant to provide.

## What you can do

- Update Roo Code to 3.26.7 or later, where the full command line is validated rather than just the leading token.
- Review agent auto-approve allowlists and disable auto-execution for compound/chained commands until validated.
- Monitor for cases where the command an agent's allowlist evaluated differs from the executable that actually ran as its child process.
- Treat any agent-run command containing &&, ||, ;, pipes, command substitution, or -c/-e wrapper flags as needing manual review, especially install one-liners piped to a shell.

## Known benign look-alikes

- Developer-authored deploy or maintenance one-liners run through the agent, e.g. "git pull && ssh deploy@host 'systemctl restart app'" or "npm ci && rsync -a dist/ user@host:/srv" (TIER2 path, needs the smuggled binary to also appear in the agent's process tree before it reports).
- Vendor install one-liners the user explicitly pasted and approved (nvm / rustup / Homebrew style "curl ... | bash"). These are genuinely high-risk when auto-executed, which is why they are reported rather than ignored.
- Legitimate inline interpreter helpers the agent writes itself, e.g. "cd repo && python3 -c 'import json,sys;print(...)'" during a refactor.
- Build scripts that read .env files or reference .ssh/ paths as part of local configuration, chained behind a benign prefix.
- Security research, CTF and detection-engineering work where bypass payloads are executed on purpose.

## References

- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1562/
- https://owasp.org/Top10/A04_2021-Insecure_Design/
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration/

---
Source: https://www.netzilo.com/threats/agent-command-allowlist-bypass