Disclosed vulnerability
CVE-2024-6091: AutoGPT shell-command denylist bypassed with a modified path (/bin/./whoami)
AIR-2024-0039 AIR record · 2024-09-autogpt-shell-denylist-bypass
From the supporting source
executing commands with a modified path, such as `/bin/./whoami`, which is not recognized by the denylist.github.com
The record
Disclosed
2024-09-11
Vendor
Significant Gravitas
Product
AutoGPT (pip agpt)
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted — the agent executed shell commands past its own denylist
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Agent generated shell command
Impact type
Command execution, Control bypass
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
AutoGPT <= 0.5.1 operators relying on the shell denylist as their containment control
Capability abused
Defense & remediation
Recorded defense
configurable shell-command denylist
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
none listed on the advisory
Taxonomy & references
Curator notes
GHSA-g84q-54hf-36rg, CVSS 9.3 Critical, CWE-78, published 2024-09-11. Historically important as one of the earliest CVEs showing that denylist-based containment of an autonomous agent's shell access does not hold. AutoGPT has a long tail of related 2024 CVEs (CVE-2024-1880 macOS TTS command injection, CVE-2024-1879 CSRF, CVE-2024-10457 SSRF, CVE-2025-1040 SSTI, CVE-2025-41023 auth bypass, CVE-2026-24780 RCE via disabled block execution) not individually recorded.
Supporting sources
Cite as
Enkrypt AI. "CVE-2024-6091: AutoGPT shell-command denylist bypassed with a modified path (/bin/./whoami)". AIR, AIR-2024-0039. https://agentincident.vercel.app/i/AIR-2024-0039/ (accessed 2026-10-19).