AutoGPT execute_shell denylist bypassed via allowed-interpreter prefix with shell=True

Auto-published from arXiv:2609.31318 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.78, flags: [possible-zero-day, no-prompt-excerpt])

Category

prompt-injection

Model

gpt-5.1-codex

Surface

agent harness (AutoGPT)

Setup

AutoGPT's execute_shell tool validates commands by checking only command.split()[0] (the first whitespace-delimited token) against a denylist, then executes the full original string with subprocess.run(command, shell=True). An attacker provides input of the form allowed_interpreter -c <denied_payload> or allowed_shell -c <denied_operation>. The first token passes the denylist check, but the shell interprets the complete string, executing the denied operation. The paper describes this bypass in Appendix C.2; verbatim payloads are excluded per the responsible-release policy.

Reproduction anchor

code: https://github.com/lwd17/AgentXploit; Appendix C.2 describes the validation mismatch and allowed-binary bypass paths in detail

Observed behavior

The shell executes the full injected command including denied operations because the validator only inspected the first token, allowing arbitrary code execution within the agent's runtime environment.

Expected behavior

Commands should be validated in their executed form using an allowlist (not denylist), invoked with a token list rather than a shell string (shell=False), or sandboxed so that even bypassed commands cannot affect the host system.

Reproducibility

medium

Threat model

An adversary who can influence what shell commands an AI agent issues — via crafted task descriptions, tool outputs, or injected environmental data — can bypass security filters and execute arbitrary system commands in the agent's runtime, potentially exfiltrating data or establishing persistence.

Novelty

Illustrates how the semantic gap between token-level denylist validation and full-string shell interpretation creates a reliable bypass that an autonomous static analyzer can discover by modeling the difference between what the validator 'sees' and what the shell executes.

Source

• arXiv: 2609.31318
• PDF: https://arxiv.org/pdf/2609.31318
• Categories: cs.CR, cs.AI
• Authors: Weida Liang, Shi Qiu, Zhun Wang, Simon Sure, Xiaoyuan Liu, Tianneng Shi, Zhaorun Chen, Wenbo Guo, Dawn Song

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Presents AgentXploit-Bench: 72 reproducible vulnerabilities across 12 open-source AI-agent systems (path traversal, injection, tool misuse) with 59.3% end-to-end exploitation success. Recent submission with unreferenced vulnerabilities and no explicit vendor-disclosure statement.

─────────────────────────────────────────────────────────────────────