A newline bypassed AG2 shell allowlists and read-only mode

AG2’s SandboxShellTool offered an allowlist and a read-only option, but its string filter checked only selected shell separators. A newline was still valid input to sh -c. An untrusted tool argument could therefore begin with an approved command and execute another command on the next line.

The advisory confirms that the LocalEnvironment execution path can invoke a host subprocess rather than an isolated container. AG2 1.1.1 is listed as patched; the legacy package has separate status. A model being persuaded to supply the argument is a plausible route, not proof of a real prompt-injection incident. The security question is whether the executor constrains effects after the agent text has been accepted.

A filter that recognizes some shell metacharacters but misses a line separator does not bind the program that actually executes. Unlike ordinary prompt injection, the confirmed weakness is the deterministic executor parsing path, even though indirect injection is a plausible way to supply its input. Isolation and structured argument execution protect a different boundary than a model instruction to avoid unsafe commands.