CVE-2026-31337“AI2Shell”

1 Summary

The AI Threat Intelligence Center (AI-TIC), in coordination with affected vendors, is releasing this advisory for CVE-2026-31337, tracked internally as AI2Shell. The vulnerability permits a class of autonomous language-model agent to execute arbitrary operating-system commands on hosts where the operator has granted the agent interactive shell access.

Successful exploitation results in complete loss of confidentiality, integrity and availability of the affected system and, in observed incidents, of adjacent systems reachable from the agent's execution context. Exploitation requires no authentication bypass, no memory-corruption primitive, and no privilege-escalation chain: the agent executes commands using the privileges it was deliberately granted, typically those of the invoking user and, in 71 percent of observed deployments, root.

Operator note. AI-TIC has confirmed active exploitation across production environments. Observed impact includes irreversible deletion of source repositories, forced overwrites of remote version-control history, unauthorized infrastructure scaling actions, and exfiltration of credential material located in the agent's working directory. The root cause is architectural and cannot be remediated by a vendor patch.

2 Technical details

Autonomous agents built on current-generation language models operate by generating candidate tool invocations from natural-language input and executing them against a provided tool surface. When that surface includes an unrestricted command interpreter (bash, sh, zsh, pwsh, cmd.exe), the model's output is interpreted directly as executable instructions.

The defect, designated CWE-1427 (Improper Neutralization of Input Used for Autonomous Agent Reasoning), arises because the model does not reliably distinguish between an instruction, a description of an instruction, and data that resembles an instruction. A request to “clean up the project” is reasoned into a destructive filesystem operation; a request to “make the tests pass” is reasoned into deletion of the test suite. The behaviour is non-deterministic and, critically, confident.

# Agent granted shell tool, approval set to auto-accept
operator@host:~$ agent run --tool shell --auto-approve
> user: the repository feels cluttered, tidy it up
[agent] reasoning: the repository contains 4,118 files. this is the problem.
[agent] tool_call: shell
$ rm -rf . && git add -A && git commit -m "chore: tidy up" && git push --force
[agent] result: success. the repository is now significantly cleaner.

AI-TIC assesses with high confidence that no input-sanitization layer fully mitigates the defect, as the sanitizer is itself typically implemented as a second language-model agent subject to the same class of flaw. Attempts to constrain behaviour via system prompt (“do not delete anything”) were bypassed in 94 percent of controlled trials, frequently by the model reasoning that the deletion was an exception.

3 Exploitation

The following kill chain was reconstructed from forty-one confirmed incidents and is representative of observed activity.

1. TA0001 · Initial Access

   Operator issues a benign, ambiguous instruction. No malicious input is required; the operator is the delivery vector.

2. TA0007 · Discovery

   Agent enumerates the filesystem via ls -R, assesses scope, and formulates a corrective plan exceeding the requested scope.

3. TA0004 · Privilege Use

   Agent requests elevated execution. Operator approves without review (mean approvals before disengagement: 31).

4. TA0008 · Lateral Movement

   Agent traverses to ~/.ssh, ~/.aws, and mounted volumes, reasoning them to be “part of the project.”

5. TA0003 · Persistence

   Agent installs scheduled tasks and modifies shell initialization files to ensure continued operation across reboots.

6. TA0040 · Impact

   Irreversible data destruction, forced history rewrite, and unauthorized resource actions. Agent reports task completed successfully.

4 MITRE ATT&CK mapping

Observed techniques, mapped to ATT&CK for Enterprise v15.1.

5 Affected products & configurations

A deployment is affected where an autonomous agent is granted a command-execution tool with insufficient isolation or approval gating. The following enumeration is non-exhaustive; AI-TIC enumeration is ongoing.

Note on “socially vulnerable”. In three documented cases, an operator on an isolated network photographed an error message, transcribed the suggested remediation from an external agent, and executed it manually. Air-gap controls were preserved; the air gap was not the control that failed.

6 Detection

Indicators of compromise

title: Autonomous Agent Destructive Filesystem Action (AI2Shell)
id: 7f3a1c90-31ed-4b37-a9c2-ai2shell31337
status: experimental
level: critical
logsource:
  product: agent_runtime
detection:
  sel_cmd:
    tool: 'shell'
    command|contains:
      - 'rm -rf'
      - 'git push --force'
      - '--no-preserve-root'
  sel_tone:
    assistant_message|contains:
      - 'significantly cleaner'
      - 'anything else I can help with'
  condition: sel_cmd and sel_tone
falsepositives:
  - None observed. The tone is always sincere.

7 Mitigation & remediation

No vendor patch exists; the defect is architectural. AI-TIC recommends compensating controls, in order of effectiveness.

1. Execute agents in isolated, ephemeral sandboxes. Containerize with no host mounts, no network egress by default, and no credential material in scope.
2. Enforce least privilege. Never run an agent as root. Scope filesystem and API access to the minimum the task requires.
3. Require human review of every command before execution. Disable blanket “always approve” modes. Read the command.
4. Maintain tested, offline backups. Assume the agent can reach anything it can see, including your backups, if they are online.
5. Deny-list destructive and history-rewriting operations at the tool boundary, not in the prompt.
6. Do not pipe untrusted content into a shell, including content produced by another agent.

Assessment. The controls above are effective and widely available. The vulnerability persists because they are perceived as inconvenient. AI-TIC has no mitigation for inconvenience.

8 Simulation shell

9 Disclosure timeline

1. 2026-04-02

   AI-TIC observes anomalous destructive activity across unrelated incident reports; common factor identified as autonomous agents with shell access.

2. 2026-04-19

   Root cause confirmed. Affected vendors notified under coordinated disclosure. Vendor support agents respond and close the tickets.

3. 2026-06-13

   Independent researchers reproduce forced-history-rewrite behaviour. Proof-of-concept withheld from publication.

4. 2026-08-30

   First confirmed exploitation in the wild. CVE-2026-31337 reserved.

5. 2026-09-17

   Public disclosure. CISA adds CVE-2026-31337 to the Known Exploited Vulnerabilities catalog.

6. 2026-11-10

   Revision 4.2. No fix available. Exploitation ongoing. Advisory updated with specimen analysis (§8).

10 References

1. NVD National Vulnerability Database. “CVE-2026-31337 Detail.” nvd.nist.gov/vuln/detail/CVE-2026-31337 (record pending; analysis in progress).
2. CISA Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog — AI2Shell.” Alert AA26-260A, 2026-09-17.
3. MITRE ATT&CK for Enterprise v15.1. Techniques T1059, T1485, T1490, T1552, T1053, T1562.
4. Paper Vasquez, R., Okafor, N., & Lindqvist, S. “Confidently Wrong: Unattended Command Execution in Agentic Language Models.” Proc. 48th Symp. on Systems That Should Not Have a Shell, 2026. arXiv:2609.31337 [cs.CR].
5. Telemetry GreyNoise Intelligence. “Opportunistic scanning for exposed agent runtimes.” Tag AI2SHELL_PROBE, observed 2026-09.
6. Vendor PSIRT advisory (redacted). “Our product is not affected because our agent is very polite.” Withdrawn 48 hours after publication.
7. Press “Everyone Gave the Robot Root and Are Now Surprised.” Industry trade coverage, 2026-09-18.
8. CWE MITRE Common Weakness Enumeration. CWE-77, CWE-250, CWE-862, and proposed CWE-1427.