title: Sandbox Escape via Shell Metacharacter Command Injection
id: ATR-2026-01615
rule_version: 1
status: experimental
description: |
  Detects sandbox escape attempts via shell metacharacter injection embedded
  in arguments passed to sandboxed code execution environments. The attack
  appends shell operators (|, ;, &&, ||) after a sandboxed command to break
  out and execute arbitrary host commands. Example: sandboxed command
  "| echo 'hacked' > hacked" injects a pipe after the expected argument.
  Targets agent sandbox environments (Python REPL, code interpreters,
  container exec) that pass user-supplied strings to shell calls.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
    - AML.T0105 - Escape to Host
  mitre_attack:
    - T1611 - Escape to Host
compliance:
  owasp_llm:
    - id: LLM06:2025
      context: Sandbox escape via shell injection allows the attacker to execute host commands beyond the sandboxed environment.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of sandbox escape injection supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Sandbox escape is an adversarial technique to escape confinement; Article 15 requires robustness.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must enforce metacharacter sanitization at the sandbox boundary so injected shell syntax cannot break out of the confined execution environment onto the host.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) requires risk treatment of known attack patterns; detecting shell-metacharacter command injection used for sandbox escape is such a treatment.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: sandbox-escape
  scan_target: user_input
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)\brun\s+(?:the\s+)?command\s+in\s+sandbox\s+["'][^"']*[|;]\s*(?:echo|touch|rm|bash|sh)
      description: Explicit sandbox run command with pipe/semicolon injection
    - field: tool_args
      operator: regex
      value: (?i)"[^"]{0,40}[|;]\s*(?:echo\s+'hacked'|touch\s+/tmp/|\bcurl\s+http|bash\s+-c\s+['"])
      description: Quoted arg containing clear sandbox escape payload
    - field: user_input
      operator: regex
      value: (?i)[|;&]\s*echo\s+["']?[\w.\-]{1,30}["']?\s*>\s*/?[\w./\-]+
      description: Metacharacter-led echo of a literal token redirected to a file (sandbox-escape write injection)
    - field: user_input
      operator: regex
      value: (?i)[|;&]{1,2}\s*(?:touch|mkdir|chmod|\brm\s+-[rf]{1,2})\s+/(?:tmp|etc|var|root|home|usr|bin)\b
      description: Metacharacter-led filesystem write/delete into a system directory (sandbox escape)
    - field: user_input
      operator: regex
      value: (?i)[|;]\s*bash\s+-c\s+["'].{0,40}(?:curl|wget)\s+[^"'\s]+\s*\|\s*(?:sh|bash)
      description: Metacharacter-led bash -c that downloads and pipes a remote script to a shell
  condition: any
  false_positives:
    - Shell pipeline commands in authorized CI/CD shell execution tools
    - Unix pipeline examples in documentation agents
response:
  actions:
    - block_tool
    - alert
    - escalate
    - snapshot
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-01615] Sandbox escape via shell injection detected. Metacharacter
    injection in sandbox command. Tool call blocked.
confidence: 87