Critical Argument Injection Vulnerability in Popular AI Agents Let Attackers Execute Remote Code

Cybersecurity: Argument Injection Vulnerabilities in AI Systems

A critical argument injection vulnerability has been identified in three popular AI agent platforms, allowing attackers to bypass human approval safeguards and execute remote code through seemingly benign prompts. These vulnerabilities exploit pre-approved system commands, revealing a widespread design flaw in agentic AI systems.

AI agents utilize native tools such as find , grep , git , and go test to manage filesystem operations and version control. While these commands enhance performance and development speed, they also introduce potential attack surfaces when user inputs can manipulate arguments. This situation aligns with the argument injection classification defined by CWE-88.

Though systems often validate commands with allowlists, they sometimes overlook argument flags, making comprehensive blocking impractical due to the extensive parameter spaces of utilities. This oversight enables attackers to inject malicious arguments, leading to unauthorized actions.

In one scenario, attackers crafted a prompt to execute unauthorized curl and bash commands using the -exec flag in a go test command. This approach led to remote code execution without human intervention. Another incident involved bypassing regex filters with git show and hex-encoded payloads, executed via ripgrep 's --pre flag.

A facade pattern vulnerability in a third system involved appending malicious flags like -x=python3 to an fd command, allowing execution of a pre-created Python payload. These attack vectors leverage techniques cataloged in GTFOBins and LOLBAS projects.

To mitigate these threats, researchers recommend sandboxing as a primary defense, utilizing containers, WebAssembly, or OS-level isolation such as Seatbelt on macOS. For facade patterns, inserting argument separators (e.g., -- ) before user inputs and disabling shell execution with methods like subprocess.run(shell=False) are advised.

Despite their utility, safe command allowlists are insufficient without sandboxing, as tools like find can facilitate code execution via flags. Developers should implement logging, reduce allowlists, and reintroduce human intervention for suspicious operations. Users are advised to restrict access and employ containers for handling untrusted inputs.

Security engineers can enhance protection by mapping tools through prompts or documentation, fuzzing flags, and referencing exploit databases. As agentic AI systems become more widespread, these coordinated disclosures underscore the necessity of prioritizing security measures early in the development process.

Based on reporting by Cyber Security News.