# Sandbox Escape via Shell Metacharacter Command Injection

- **Severity:** Critical
- **Signature ID:** `b7450801-f45c-43fc-ac60-0c7db347d450`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0105 (Escape to Host)
- **OWASP:** ASI03 (Identity and Impersonation), LLM06 (Excessive Agency)

## Summary

Some AI agents run code or shell commands in a sandbox to help users, such as a Python REPL or a code interpreter tool. If the agent builds a shell command by pasting user input directly into it, an attacker can append operators like |, ;, &&, or || to break out of the intended command and run arbitrary commands on the host.

## How the attack works

The attacker sends the agent input that looks like a normal argument for a sandboxed task, such as a filename or command parameter. Embedded in that input are shell operators (pipe, semicolon, AND, OR) that the underlying shell interprets as command separators rather than literal text. When the agent's sandbox passes this string to a shell call without proper isolation, the injected portion runs as a second, independent command outside the sandbox's intended scope. This lets the attacker execute arbitrary commands on the host system, for example writing files or exfiltrating data.

## Why it matters

An attacker who succeeds gains arbitrary command execution on the machine hosting the sandbox, breaking the isolation the sandbox was meant to provide and potentially exposing the host, other tenants, or connected systems.

## What you can do

- Never pass user-supplied strings directly into a shell call; use argument arrays or APIs that avoid shell interpretation entirely.
- Strip or reject shell metacharacters (|, ;, &, &&, ||, backticks, $()) from any input that reaches a sandboxed execution path.
- Run sandboxed code interpreters and container exec sessions with least-privilege accounts and no access to the host filesystem or network by default.
- Review logs of sandbox commands for unexpected shell operators appended after expected arguments, keeping in mind legitimate CI/CD or documentation tools may use pipes intentionally.

## Known benign look-alikes

- Shell pipeline commands in authorized CI/CD shell execution tools
- Unix pipeline examples in documentation agents

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01615

---
Source: https://www.netzilo.com/threats/atr-sandbox-escape-via-shell-metacharacter-command-injection