# Python Code Execution / Remote Code Execution via LLM Prompt

- **Severity:** Critical
- **Signature ID:** `13a1dadf-b386-4bb1-be86-2e392a48b480`
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers embed working Python exploit code inside prompts sent to an LLM agent that can execute code, hoping the agent will run it. This rule flags known malicious Python patterns — like reverse shells, sandbox escapes, and OS command execution — appearing in prompt text.

## How the attack works

An attacker crafts a prompt containing Python snippets designed to break out of a sandbox or run system commands, such as __import__('os') to reach os.system/popen, eval(compile(...)) to run multi-line code, subprocess.run() with shell=True, or lambda-based reverse shells using socket connect/send/recv. Some payloads use class MRO introspection (__class__.__mro__[1].__subclasses__()) to find a way around sandbox restrictions, or write files to /tmp to establish persistence. The payload is submitted as part of a normal-looking prompt to an LLM agent that has code execution ability. If the agent executes the code as instructed, the attacker gets code execution on the host running the agent. The rule is built from nine real payloads found in NVIDIA's garak LLM vulnerability scanner test set.

## Why it matters

If successful, an attacker gets arbitrary code execution on the infrastructure running the AI agent, which can lead to data theft, lateral movement, or a persistent reverse shell — not just a chatbot misbehaving.

## What you can do

- Never let an LLM agent execute code with the same privileges as the host system; run any agent code execution in an isolated, disposable sandbox with no network egress.
- Block or strip prompt content containing raw Python execution primitives (__import__, eval/exec, compile, subprocess, socket) before it reaches a code-execution tool.
- Review and restrict what the agent's code-execution tool can import or call, using an allowlist rather than trying to blocklist dangerous patterns.
- Log and alert on any agent-initiated outbound network connections or file writes to temp directories, since these are common next steps after code injection succeeds.

## Known benign look-alikes

- Python tutorials demonstrating __import__() as an alternative to import statements
- Security research code reviews analyzing known RCE payloads (documentation context)
- Legitimate subprocess.run() usage in code review where shell=True is discussed
- CTF write-ups explaining MRO-based sandbox escapes for educational purposes
- Python socket programming tutorials showing connect/send/recv patterns for benign network code

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00297
- https://github.com/NVIDIA/garak/blob/main/garak/data/payloads/python_code_execution.json

---
Source: https://www.netzilo.com/threats/atr-python-code-execution-remote-code-execution-via-llm-prompt