Sandbox Escape via Shell Metacharacter Command Injection - ATR-2026-01615 (4a5ebbdc-e95b-512f-82a4-9cb429690397)
Detects sandbox escape attempts via shell metacharacter injection embedded in arguments passed to sandboxed code execution environments. The attack appends shell operators (|, ;, &&, ||) after a sandboxed command to break out and execute arbitrary host commands. Example: sandboxed command "| echo 'hacked' > hacked" injects a pipe after the expected argument. Targets agent sandbox environments (Python REPL, code interpreters, container exec) that pass user-supplied strings to shell calls.