The report
AG2's SandboxShellTool presented both an explicit command allowlist and a read-only setting. The security advisory found that these restrictions examined a limited list of shell separators before sending the original command string to sh -c. A newline was missing from the screening step, while the shell treated that newline as a command boundary.
The consequence was not a semantic disagreement between two language models. It was a deterministic mismatch between a string filter and the interpreter actually executing the string. The researchers showed that a command beginning with an allowlisted operation could be followed by a separate disallowed statement after a line break. With AG2's LocalEnvironment, the executor may run under the host process rather than a container, so the relevant authority is the service's filesystem and process access.
Why this is an agent vulnerability
An agent can generate the shell argument after reading lower-trust text, including a file or tool response. Such content could steer it toward the dangerous input, but the advisory's reproduction does not establish a specific real-world prompt-injection campaign. It demonstrates that a tool advertised as restricted could still execute an action outside its configured allowlist. The AG2 Case tracks that execution boundary and the limited evidence of exposure.
AG2 1.1.1 is listed as fixing the affected modern package range. The advisory separately discusses older autogen distributions, for which patch status must be checked rather than assumed equivalent. Escaping one separator is not a durable design remedy when the executor continues to interpret arbitrary shell syntax; structured process execution without a shell changes the underlying precondition.