Disclosed vulnerability
Bypassing command allowlists turns prompt injection into RCE in three AI coding agents
AIR-2025-0154 AIR record · 2025-10-trailofbits-prompt-injection-rce
From the supporting source
Pre-approved commands create a security drawback: they expose an argument injection attack surface when user input can influence command parameters.blog.trailofbits.com
The record
Disclosed
2025-10-22
Vendor
multiple
Product
Three unnamed AI coding agents (prior work cites Amazon Q, Claude Code, Cursor)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agents executed commands past their allowlists
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection repository content
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Agents relying on pre-approved command allowlists without sandboxing
Capability abused
Defense & remediation
Recorded defense
Human approval prompts and pre-approved command allowlists
Guardrail kinds
Human approval, Permission scope
Guardrail outcome
Silent
Taxonomy & references
Curator notes
Author Will Vandevanter. Products unnamed 'due to ongoing coordinated disclosure'. CVE-2025-54795 (Claude Code) and GHSA-534m-3w6r-8pqr (Cursor) are cited as prior work, not as this post's own findings.
Cite as
Enkrypt AI. "Bypassing command allowlists turns prompt injection into RCE in three AI coding agents". AIR, AIR-2025-0154. https://agentincident.vercel.app/i/AIR-2025-0154/ (accessed 2026-10-19).