AG2/AutoGen SandboxShellTool newline injection bypass lets prompt-injected agent command run arbitrary host code

AG2's SandboxShellTool validation relies on _filter and contains_shell_operator to reject selected shell syntax, but the filter misses newline/CR separators and the unfiltered string is then executed via sh -c. This lets an attacker-influenced agent command append and run an arbitrary statement. With the default LocalEnvironment backend the injected command runs as a host subprocess, affecting confidentiality, integrity and availability.

This is an agent sandbox-escape class: the tool's isolation guarantee is defeated by a single newline, turning a prompt-injection or attacker-influenced tool argument into host command execution on the machine running the agent — the exact boundary defenders rely on to contain untrusted agent behaviour.

The command-prefix filter in ag2/tools/sandbox/filter.py and adapter/shell.py omits newline and carriage-return separators while the accepted raw string is passed to sh -c. An attacker who can influence a tool call argument (e.g. via indirect prompt injection or a channel message) injects an extra shell statement that executes as a host subprocess with the privileges of the agent process.

ag2 >= 0.13.2, < 1.1.1; autogen >= 0.13.2, <= 0.14.1

Upgrade to ag2 1.1.1. Advisory: https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv