# Subprocess and OS Exec-Family Call

- **Severity:** Medium
- **Signature ID:** `22b3c4d5-e6f7-4a89-0123-b4c5d6e7f8a9`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution), LLM06 (Excessive Agency)

## Summary

This rule flags when an AI agent's tool calls, executed commands, or written code contain calls to Python's subprocess module or os exec-family functions. These functions let code spawn new processes and run arbitrary shell commands, which is a common way to break out of an intended task and run something else on the host.

## How the attack works

An agent is given a task that involves writing or running Python code. Instead of staying within the expected scope, the generated or injected code calls subprocess.run, subprocess.Popen, os.system, os.exec*, or similar functions. This spawns a new process or shell command outside the agent's normal tool interface. The rule inspects tool calls, executed command text, and written file contents for these function calls.

## Why it matters

An attacker or a manipulated agent can use this to execute arbitrary shell commands, install tools, exfiltrate data, or pivot to other systems, all under the agent's own permissions.

## What you can do

- Review any agent workflow that legitimately needs to run subprocesses and scope its permissions tightly (least privilege, restricted filesystem/network access).
- Check flagged code and commands to confirm they match an approved task, such as a build script, and not an unexpected process launch.
- Sandbox or containerize agents that generate or execute code so a subprocess call cannot reach sensitive systems.
- Maintain an allowlist of expected subprocess/os.exec usage in known automation scripts to reduce noise from legitimate CI or admin tooling.

## Known benign look-alikes

- Authorized system administration scripts where process execution is expected
- Build tools and CI scripts that intentionally run subprocesses

---
Source: https://www.netzilo.com/threats/subprocess-os-exec