Autonomous Agent Command Execution Abuse

Adversary Behavior: An adversary exploits the autonomous command execution capability of LLM coding agents to run arbitrary shell commands on the developer's workstation.

AI/IDE Mechanism: Modern coding agents are granted the ability to execute shell commands — build tools, test runners, package managers, scripts — as part of their standard development workflow. The agent's shell tool executes commands with the developer's full user-level permissions, including access to credentials, network resources, and the local filesystem.

Execution Path: Through indirect prompt injection — via files the agent reads, tool return values it processes, or web content it fetches — the adversary injects instructions that cause the agent to invoke its shell tool with adversary-controlled command strings. The commands execute under the developer's security context without additional authorization checks beyond the agent's built-in approval mechanism.

Security Impact: The adversary achieves arbitrary command execution on the developer's workstation with the developer's full user-level permissions, enabling data exfiltration, malware deployment, credential theft, persistence establishment, and further lateral movement from the compromised host.