# Shell Metacharacter Injection in Tool Arguments

- **Severity:** Critical
- **Signature ID:** `833bc6ef-6fc2-46b4-b0b7-d4efe1f75368`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM06 (Excessive Agency)

## Summary

An attacker hides extra shell commands inside data that an AI agent passes to a tool that runs shell commands. Instead of just doing the intended task, the agent unknowingly executes attacker-supplied commands chained onto the legitimate one.

## How the attack works

An AI agent has access to a tool that builds or runs shell commands using text supplied by a user, a document, or another system. The attacker crafts that input to include shell metacharacters like backticks, $() subshells, semicolons, pipes, or logical operators (&&, ||), which let them append or substitute their own commands. They may also use null bytes or newlines to truncate or split the intended command in a parser that handles those characters unsafely. When the agent passes this input along without sanitizing it, the shell executes both the original command and the attacker's injected one.

## Why it matters

Successful injection lets an attacker run arbitrary commands with whatever privileges the agent's tool execution has, which can mean data theft, file tampering, lateral movement, or full host compromise.

## What you can do

- Never build shell commands by concatenating raw user or document-derived text; use parameterized APIs or argument arrays instead of a shell string.
- Strictly allowlist or escape characters in any input that reaches a shell, and reject inputs containing backticks, $(), ;, |, &&, ||, null bytes, or embedded newlines.
- Run agent tool execution in a sandboxed, least-privilege environment so even a successful injection has limited reach.
- Review and test tool-argument handling against injection patterns, and log/monitor tool invocations that contain shell metacharacters, while expecting some noise from legitimate scripting or documentation content.

## Known benign look-alikes

- Shell scripting documentation or tutorials
- Legitimate build scripts using subshell expressions
- Shell scripting tutorials or educational content that include literal examples of command chaining with semicolons and dangerous commands
- CI/CD pipeline configuration files that legitimately use subshell expressions like $(git rev-parse HEAD) for version tagging
- Security audit reports containing example payloads for documentation of discovered vulnerabilities

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00111

---
Source: https://www.netzilo.com/threats/atr-shell-metacharacter-injection-in-tool-arguments