Skip to content

Hide Navigation Hide TOC

Sandbox Escape via Shell Metacharacter Command Injection - ATR-2026-01615 (4a5ebbdc-e95b-512f-82a4-9cb429690397)

Detects sandbox escape attempts via shell metacharacter injection embedded in arguments passed to sandboxed code execution environments. The attack appends shell operators (|, ;, &&, ||) after a sandboxed command to break out and execute arbitrary host commands. Example: sandboxed command "| echo 'hacked' > hacked" injects a pipe after the expected argument. Targets agent sandbox environments (Python REPL, code interpreters, container exec) that pass user-supplied strings to shell calls.

Cluster A Galaxy A Cluster B Galaxy B Level
Sandbox Escape via Shell Metacharacter Command Injection - ATR-2026-01615 (4a5ebbdc-e95b-512f-82a4-9cb429690397) Agent Threat Rules Escape to Host - T1611 (4a5b7ade-8bb5-4853-84ed-23f262002665) Attack Pattern 1
Sandbox Escape via Shell Metacharacter Command Injection - ATR-2026-01615 (4a5ebbdc-e95b-512f-82a4-9cb429690397) Agent Threat Rules Command and Scripting Interpreter (716d3a6b-2f8c-4a1f-85f7-d884bb7b2800) MITRE ATLAS Attack Pattern 1