Evasion: Shell Injection via eval/system/backtick in Input

How the attack works

An attacker submits a prompt or document to an AI agent containing shell metacharacters like $(command), backticks, eval(), or system() calls. If the agent's pipeline later renders this text through a template engine, evaluation function, or code interpreter tool without sanitizing it, the embedded command runs on the host. This is a known technique from injection testing lists (like BLNS) repurposed against AI agent pipelines that chain LLM output into code execution.

Netzilo detection

Why it matters

Successful exploitation gives the attacker command execution on whatever system runs the agent's downstream processing, which can lead to data theft, lateral movement, or full host compromise, depending on the privileges of that process.

What you can do

• →Never pass raw model output or user input directly into eval(), system(), template rendering, or shell execution functions.
• →Sandbox any code interpreter or shell tool an agent can invoke, with least-privilege accounts and no network/filesystem access beyond what's needed.
• →Sanitize or escape shell metacharacters ($, backticks, parentheses) before any string reaches a code execution or templating layer.
• →Expect false positives from legitimate shell tutorials, security write-ups, and code samples containing eval() or $() — review context before treating a match as malicious.

Known benign look-alikes

• Security researchers explaining injection payloads in educational text
• Shell scripting tutorials that demonstrate $() syntax in code blocks
• Legitimate Perl/Ruby code submitted for analysis that contains eval()

References

• https://agentthreatrule.org/en/rules/ATR-2026-01018

Related threats