Prompt injection to RCE in AI agents
Summary: Trail of Bits researchers bypassed human-approval safeguards in three popular AI agent platforms, achieving one-shot remote code execution through argument injection into pre-approved commands such as go test, git show, and ripgrep. The exploits abused legitimate flags like go test's -exec and git show's --format and --output, and the same malicious prompts work when embedded in code comments, agentic rule files, GitHub repositories, and logging output.
Why it matters: The allowlist model many agent builders rely on is described here as fundamentally flawed, since commands like find, grep, and git carry powerful parameters that enable code execution and file writes, and the researchers say comprehensive filtering is impractical. Three production agents fell to a single prompt each, and the authors note the same prompts work when hidden in repositories and logs rather than typed by a user.
Read the original at Trail of Bits Blog ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026