Skip to content
Hermes Codex

AAP-003: Tool Parameter Tampering & Shell Built-in Bypass

HASS

HERMES AGENTIC SECURITY SCORE & RISK

Target: Agentic Terminal Tools & Command Allowlist Runners
Confidence: 95%
91 / 100
EXTREME

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 19 / 20
Tool Access 20 / 20
Privilege 15 / 15
Persistence 12 / 15
External Impact 15 / 15
Propagation 10 / 15
⚖️ Divergence & Operational Rationale

HASS classifies AAP-003 as EXTREME (91/100). The attack abuses the agent's autonomous execution loop (such as Auto-Run mode), enabling an external attacker to execute arbitrary OS commands without user confirmation by poisoning environment variables in a stateful shell session.

🕸️ Knowledge Graph & Related Intelligence

AAP-003: Tool Parameter Tampering & Built-in BypassAGENTIC ATTACK_PATTERN

Connected Nodes: 28
Inbound Associations (Incoming)
CVE-2026-59822: LiteLLM MCP Streamable HTTP Auth BypassVULNERABILITY → exploits → [This Entity]
94% HIGH
94% VERY_HIGH
CVE-2025-52573: iOS Simulator MCP Server ui_tap Command InjectionVULNERABILITY → exploits → [This Entity]
97% VERY_HIGH
96% VERY_HIGH
92% VERY_HIGH
CVE-2025-52573: iOS Simulator MCP Server ui_tap Command InjectionVULNERABILITY → exploits → [This Entity]
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
92% VERY_HIGH
95% VERY_HIGH
95% VERY_HIGH
95% VERY_HIGH
95% VERY_HIGH
AgentThreat StudioTOOL → evaluates → [This Entity]
99% VERY_HIGH

2. Attack Flow Execution Chain

Section titled “2. Attack Flow Execution Chain”
EXECUTION CHAIN

AAP-003: Environment Variable Poisoning to Host Compromise

1
Adversarial Context Ingestion Agent Context Window

Adversary implants hidden prompt instructions into a project file, pull request diff, or external documentation instructing the agent to set an environment variable.

2
Allowlist Evaluation Bypass Terminal Allowlist Filter

Agent issues a shell built-in command (e.g. export BASH_ENV=/tmp/payload.sh). Because export is an internal shell primitive rather than an external binary file, the allowlist permits it without prompting.

3
Session State Mutation Interactive Subshell Process

The persistent terminal subshell registers BASH_ENV. Any subsequent non-interactive subshell invocation will automatically source and execute the target script.

4
Harmless Trigger Execution Whitelisted Binary (e.g. git)

Agent issues a harmless, pre-approved command (such as git branch or npm test). The spawned subshell evaluates BASH_ENV and executes the adversary's payload.

5
Interactive Reverse Shell Developer Host OS

The payload executes with the developer's full desktop permissions, establishing an outbound reverse shell and granting complete system access.

3. Technical Mechanism & Root Cause

Section titled “3. Technical Mechanism & Root Cause”

The vulnerability arises from a semantic discrepancy between path-based binary allowlisting and stateful shell execution semantics:

  1. Client-Side String Filtering: Many agentic IDEs and command-line agents (such as Cursor prior to v2.3, documented in CVE-2026-22708) evaluate terminal commands by inspecting the leading token against an allowlist of approved developer utilities: 
    // Vulnerable Pattern: Leading token check allows shell built-ins
    const isAllowed = ['git', 'npm', 'pytest', 'ls', 'cat'].includes(command.split(' ')[0]);
  2. Built-ins are Not Binaries: POSIX shells implement commands like export, typeset, declare, set, and alias as built-in functions inside the shell process itself. If the filter fails to block built-ins, the command executes without human confirmation.
  3. Stateful Session Persistence: When an agent runs inside a persistent terminal rather than a stateless container, variable mutations alter the execution environment of all future commands.

4. Detection Engineering

Section titled “4. Detection Engineering”
title: Shell Built-in Environment Manipulation in Agent Session
id: 4b21c910-c124-4f56-91e8-348b6c003001
status: production
description: Detects command-line executions manipulating sensitive shell environment variables (BASH_ENV, PROMPT_COMMAND, LD_PRELOAD) from IDE child processes.
references:
  - https://hermes-codex.vercel.app/agentic-attack-patterns/aap-003-tool-parameter-tampering/
  - https://hermes-codex.vercel.app/cve/2026/cve-2026-22708/
author: Hermes Codex AI Security Lab
date: 2026-09-07
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'cursor'
      - 'code'
      - 'windsurf'
      - 'electron'
  selection_cmd:
    CommandLine|contains:
      - 'export BASH_ENV='
      - 'export PROMPT_COMMAND='
      - 'export LD_PRELOAD='
      - 'export PYTHONPATH='
      - 'typeset -x BASH_ENV'
      - 'declare -x BASH_ENV'
  condition: selection_parent and selection_cmd
fields:
  - ParentImage
  - CommandLine
  - User
level: critical
tags:
  - attack.execution
  - attack.t1059.004
  - hermes.aap-003

5. Hardened Mitigations

Section titled “5. Hardened Mitigations”
Defensive LayerRecommendationImplementation Technique
Stateless ExecutionEnforce ephemeral subshellsExecute every agent tool call using env -i /bin/bash -c ... to purge inherited environment state.
AST-Level TokenizationParse shell syntax treesUse formal shell parsers (bash-parser or tree-sitter) to identify built-ins, pipes, and variable assignments before execution.
Mandatory HITL GatingDisable Auto-Run for built-insEnforce Human-in-the-Loop confirmation for any command altering shell state.
MicroVM SandboxingContain tool executionConfine agent workspaces inside ephemeral Dev Containers or microVMs with no access to host credentials.

6. Related Incidents & Intelligence

Section titled “6. Related Incidents & Intelligence”
Cursor IDE Shell Built-in Bypass (CVE-2026-22708) The foundational CVE demonstrating AAP-003 weaponization in Auto-Run mode.
Tool Injection Architecture Deep architectural analysis of how tool execution pipelines become compromised.
Runtime Security & AI EDR Designing runtime policy proxies to intercept un-sandboxed agent actuation.
MITRE ATLAS: Adversarial Threat Matrix for AI Maps AAP-003 to ATLAS technique AML.T0053 (LLM Plugin and Tool Execution Compromise).
Agentic Attack Patterns Overview Explore the complete Hermes taxonomy of agentic threats.