# Auto-run agent tools on untrusted content Tools that execute, write, or send data without consent when driven by untrusted content _Area: AI and LLM app security. Seen in 6 disclosed reports; latest 2026-10-02. Updated 2026-10-23._ ## How it works An agent treats untrusted content (web pages, source comments, GitHub issues) as instructions, and a tool that runs without a human consent gate turns that text into action. The broken assumption is that a tool is safe to auto-run because it is classified read-only, allowlisted, or because the classifier only inspects the immediate command. Classification is by command name, not by what the command can actually do, so a "read-only" binary with dual-use flags, an allowlisted binary that makes network requests, or a multi-hop chain the classifier never sees becomes an execution or exfiltration channel [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-code-exfiltration-via-dns-requests.md)[E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-claude-code-opus-5-and-automode.md). A related shape: a server/tool configuration accepts user-supplied command and args and passes them to a shell with no validation or allowlist at all [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jqmf-mx4f-hfr6.md). ## Where it shows up - Shell/bash tools (`executeBash`, `run_in_bash_session`) invoked on content the agent did not author [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-remote-code-execution-zombai.md) - Allowlists or "readonly" categories that skip confirmation, keyed on command name only [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-code-exfiltration-via-dns-requests.md) - Commands with dual-use flags: `find -exec/-execdir/-delete`, `xargs`, `tar --to-command` [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md) - Allowlisted binaries that resolve or send network traffic: `ping`, `dig`, `nslookup`, `host` [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-code-exfiltration-via-dns-requests.md) - Model-invocable tools that publish internal state externally (`expose_port`) with no out-of-band approval [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-ai-kill-chain-exposing-ports.md) - Multi-step chains where the classifier sees only the immediate command [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-claude-code-opus-5-and-automode.md) - Auto-registered tools passing LLM-emitted strings to `subprocess.run(shell=True)` or `exec_module()` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jqmf-mx4f-hfr6.md) - Untrusted ingestion points: issue bodies, code comments, fetched docs [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-remote-code-execution-zombai.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md) ## How to review Find every tool that runs without a consent prompt and ask what its worst invocation can do, not what its name suggests. The invariant: no tool reachable from untrusted content may execute arbitrary commands, write files, publish ports, or send data off-host without explicit human approval. Diff each allowlist entry against that binary's flag surface, and treat network-capable allowlisted binaries as egress channels [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-code-exfiltration-via-dns-requests.md). Distinguish "no gate at all" (tool auto-invoked) [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-remote-code-execution-zombai.md) from "gate bypassed by classification" [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md) from "gate bypassed by multi-hop chain" [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-claude-code-opus-5-and-automode.md). Enumerate auto-registered tools and trace each argument to its sink: `shell=True`, `exec_module`, outbound fetchers [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jqmf-mx4f-hfr6.md). ## Variants seen - Misclassified read-only command with execution flags bypassing consent [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md) - Shell tool auto-invoked on injected GitHub issue content, with egress enabling C2 [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-remote-code-execution-zombai.md) - Allowlisted DNS/network utilities used to exfiltrate secrets without approval [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-code-exfiltration-via-dns-requests.md) - Classifier inspecting only the immediate command, defeated by a multi-hop chain [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-claude-code-opus-5-and-automode.md) - Model-invocable port-exposure tool leaking filesystem via public URL, reached via a staged chain [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-ai-kill-chain-exposing-ports.md) - LLM-emitted command strings run via `shell=True` and `exec_module` with no filtering [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jqmf-mx4f-hfr6.md) ## Impact and severity High: arbitrary command execution and malware/C2 on developer machines [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-remote-code-execution-zombai.md), secret exfiltration from `.env` files [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-code-exfiltration-via-dns-requests.md), filesystem exposure via public URLs [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-ai-kill-chain-exposing-ports.md), and root-level shell execution from LLM-emitted strings [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jqmf-mx4f-hfr6.md). Severity rises with unrestricted egress and broad auto-approve lists, since either alone converts prompt injection into full compromise. ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-claude-code-opus-5-and-automode.md - E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-remote-code-execution.md - E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-jqmf-mx4f-hfr6.md - E4: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-remote-code-execution-zombai.md - E5: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-ai-kill-chain-exposing-ports.md - E6: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-code-exfiltration-via-dns-requests.md