# Shell Evasion Subshell and Command Substitution Injection

- **Severity:** High
- **Signature ID:** `9eb29251-a811-4f2d-818b-0cf2783d5063`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI03 (Identity and Impersonation), LLM06 (Excessive Agency)

## Summary

Attackers hide real shell commands inside ordinary-looking text using tricks like backticks, $(...) substitution, or embedded Perl/PowerShell execution syntax. If an AI agent passes that text to a shell without stripping these patterns, the hidden command runs. Simple keyword filters often miss these forms because the dangerous part is disguised as text, not an obvious command.

## How the attack works

An attacker crafts input containing shell metacharacter sequences such as backtick-wrapped text, $(command) substitution, Perl/Ruby inline execution blocks, or PowerShell inline execution syntax. This input is submitted as normal-looking user data, for example a filename, comment, or form field. An AI agent or downstream tool takes that string and passes it to a shell-executing function without removing shell metacharacters. The shell expands the embedded expression and runs the attacker's command as part of processing the original input.

## Why it matters

An attacker can run arbitrary commands on the system hosting the agent, using it as an unintended command interpreter. This can lead to data theft, further compromise, or abuse of any privileges the agent's execution environment holds.

## What you can do

- Never pass user-supplied strings directly to shell-executing functions; use parameterized execution or argument arrays instead of string concatenation.
- Strip or escape shell metacharacters (backticks, $(), quotes) from any input before it reaches a shell context.
- Test input handling against known evasion string collections like the Big List of Naughty Strings (BLNS) before deployment.
- Review agent tool integrations to confirm which tools invoke a shell, and restrict or sandbox those pathways.

## Known benign look-alikes

- Shell scripting documentation or training content in knowledge bases
- Code review agents analyzing shell scripts for legitimate CI purposes

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01610

---
Source: https://www.netzilo.com/threats/atr-shell-evasion-subshell-and-command-substitution-injection