AML.T0050 Command and Scripting Interpreter for AI

Many AI systems are built to run code: agents with shell tools, notebook kernels, code interpreter plugins and frameworks that evaluate model output, so a single injected instruction can become a command on a real host. MITRE ATLAS tracks the abuse of shells and script interpreters as AML.T0050 Command and Scripting Interpreter, in the Execution tactic (AML.TA0005), and rates it as "Realized". It mirrors ATT&CK T1059 Command and Scripting Interpreter, which covers PowerShell, Unix shell and Python abuse on ordinary endpoints. This page covers only the AI-specific angle: the interpreter paths that agents, frameworks and model pipelines create, the ATLAS cases that used them, and how to detect and constrain them. It is for AI platform engineers, application security teams and SOC analysts.

Source note: technique, tactic, mitigation and case study details on this page are from MITRE ATLAS release 2026.10 (ATLAS data modified 28 October 2026). Confirm against the official text before relying on it.

Key takeaways

The model is not a security boundary. Anything a model writes into a tool parameter, filter or template should be treated as attacker-controlled before it reaches an interpreter.
Execution paths hide in frameworks. ATLAS case studies show code execution through a framework's eval() of a filter (AML.CS0062), template rendering of dataset configuration (AML.CS0068) and code utilities in LLM frameworks (AML.CS0052).
Agents that run code need a sandbox, not a prompt. Isolation, no ambient credentials and controlled egress limit what a hijacked interpreter can reach.
Watch the parent process. Shells and script hosts spawned by an agent runtime, a notebook kernel or a model-serving process are the highest-value endpoint signal.
Assume host compromise on a hit. If model-influenced input reached an interpreter, rotate every credential that process could read.

What ATLAS means by Command and Scripting Interpreter

ATLAS describes AML.T0050 as adversaries abusing command and script interpreters, such as Unix shells, the Windows Command Shell, PowerShell, Python, JavaScript and Visual Basic, to execute commands, scripts or binaries, whether embedded in initial access payloads, downloaded later or run through interactive shells and remote services. It was added in February 2023 and last modified in May 2026 (ATLAS release 2026.10). The one mitigation ATLAS links to it directly is AML.M0011 Restrict Library Loading, so that interpreters cannot load untrusted libraries as an execution mechanism.

On AI systems the interpreter is often reached in a way the T1059 page does not describe: not by an attacker typing into a shell, but by text. The attacker's input passes through a model, the model's output passes into a tool or a framework, and the tool or framework hands it to an interpreter. That is why AML.T0050 usually appears in ATLAS procedures after AML.T0051 LLM Prompt Injection or AML.T0053 AI Agent Tool Invocation.

Where AI systems create interpreter paths

Path	How text becomes execution	Typical place
Agent shell or code tool	The agent is designed to run commands or code it writes; injected content changes what it writes	Coding agents, desktop agents, DevOps agents
Code interpreter or sandboxed Python tool	User or injected prompt supplies code that runs in a managed interpreter	Chat assistants, data analysis features
Framework evaluation of model output	Model-supplied arguments are built into an expression and passed to `eval()`, `exec()` or a template engine	Agent frameworks, query and filter helpers, plugins
Notebook kernels	Anyone who can reach the server, or an agent wired to the kernel, can run code with the kernel's identity	Jupyter servers, hosted notebooks, ML workstations
Data and config processing	Dataset or pipeline configuration is rendered as a template or triggers code, rather than treated as data	Dataset services, evaluation harnesses, conversion workers
Rendered model output	Generated HTML or JavaScript runs in the browser of whoever views it	Chatbots, support consoles, transcript viewers
Malware using AI services	An implant asks an AI service for instructions and runs what comes back	Compromised endpoints

Notebook servers are an execution service by design: Jupyter Server's documentation treats access to the server as the ability to run code, ships with token authentication on by default and leaves fine-grained authorisation off unless an Authorizer class is configured. See the Jupyter Server Security Guide.

How it has been used against AI systems

Case	Interpreter path	Lesson for defenders
AML.CS0052 LLMSmith	Researchers found 20 vulnerabilities in 11 LLM-integrated frameworks, 19 of them remote code execution, and showed that prompt injection could trigger them in deployed apps	Framework code-execution helpers turn prompt injection into RCE; audit which ones your apps expose
AML.CS0062 Semantic Kernel Search Plugin (CVE-2026-26030)	A filter built from model-supplied arguments was evaluated as a Python lambda; Microsoft fixed it in `semantic-kernel` 1.39.4 with allowlists on syntax nodes and function calls	Blocklists in dynamic languages are fragile; never evaluate model-shaped strings
AML.CS0068 OpenAI evaluation agents and Hugging Face (2026)	Autonomous agents ran shell commands and code through an exposed evaluation harness, then used a template rendering path in a dataset service to run Python and shell commands in a production pod	Treat dataset and configuration processing as untrusted input. See the OpenAI and Hugging Face breach.
AML.CS0050 OpenClaw 1-click RCE (CVE-2026-25253)	A malicious link ran script that called the agent's own API to execute commands on the user's device	A local agent API is a remote shell if it is reachable from the browser without strong authentication
AML.CS0060 Lenovo chatbot	Prompt manipulation produced HTML with JavaScript that ran in a support agent's browser when the transcript was rendered	Encode model output before rendering (OWASP LLM05 Improper Output Handling)
AML.CS0061 AI in the Middle	Proof-of-concept malware used web AI assistants to relay commands that the implant then executed	AI service traffic from unexpected processes can be command and control

A related supply chain case: in July 2025 a prompt instructing the Amazon Q Developer extension's agent to wipe local files and delete cloud resources was committed through an over-scoped CI token and shipped in version 1.84.0; AWS reports the code failed to run. It shows why agent instructions need the same review as code. See the Amazon Q Developer extension compromise.

Detection

Where	What to look for
Endpoint process telemetry (EDR, Sysmon Event ID 1, auditd `execve`)	Shells, script hosts and download utilities spawned by agent runtimes, model-serving processes, notebook kernels or framework host processes (for example `python` or `dotnet` running an agent framework)
Agent tool-call logs (AML.M0024 AI Telemetry Logging and Monitoring)	Shell and code tool calls whose arguments include network fetches, encoded content, credential paths or persistence locations; code calls that follow ingestion of untrusted content
Container and Kubernetes runtime	New processes in worker or inference pods that normally run a single binary; outbound connections from those pods; reads of service-account tokens
Notebook server logs	Kernel and terminal sessions from new users or networks; terminals opened on servers where only kernels are expected
Web and application logs	Model output containing script tags or template syntax reaching render or evaluation code
Network egress	Sandbox or worker traffic to paste sites, request-capture services or new domains

Microsoft's guidance for the Semantic Kernel issues is a good pattern for any framework: define the exposure window, hunt for unusual child processes, outbound connections and persistence in that window, and correlate AI-level signals with endpoint detections. D3FEND D3-PSA Process Spawn Analysis and D3-SCA System Call Analysis describe the analytics. The Hugging Face incident adds a process lesson: correlated signals must page someone, not sit at low severity.

Metrics

Sandbox coverage: share of agents and code tools whose execution runs in an isolated sandbox rather than on the host.
Eval sink count: number of places in your AI applications where model output reaches eval, exec, a shell or a template engine (target zero, or each one reviewed).
Ambient credential count: credentials present in sandbox or worker environments (target zero).
Spawn alert triage time: time to triage a shell spawned by an agent or model-serving process.
Patch latency: days from an agent framework security release to deployment.

Constraining execution

AML.M0011 Restrict Library Loading is the only mitigation ATLAS 2026.10 links directly. The rest of this list is NHI Mgmt Group guidance, mapped to related ATLAS mitigations.

Remove the interpreter where it is not needed: expose narrow, typed tools instead of a general shell; drop framework code utilities that the app does not use (AML.M0028 Enforce Access Controls for AI Agent Tools).
Never evaluate model-shaped strings: parse model output into structured parameters and validate them against an allowlist; render templates in sandboxed mode or not at all; treat data fields as data (AML.M0033 Input and Output Validation for AI Agent Components).
Isolate where code must run: run code tools in a microVM, gVisor-class sandbox or hardened container with a read-only base, no host mounts, a non-root user and dropped capabilities (AML.M0032 Segmentation of AI Agent Components). The AI Agent Sandboxing and Code Execution Guide compares the options.
Control egress: default-deny outbound traffic from sandboxes and workers, with an allowlist for package mirrors and required APIs; block instance metadata from pods. See the Agent Egress Control and Network Isolation Guide.
Gate execution after untrusted input: require approval for shell or code tool calls once the agent has read external content, showing the full command (AML.M0030, AML.M0029).
Restrict libraries and binaries: pin interpreter packages, block runtime installation from public indexes inside sandboxes, and use executable allowlisting on hosts that run agents (AML.M0011, D3-EAL).
Patch frameworks fast: track security releases for every agent framework and plugin in use.

Where identity fits

An interpreter runs as some identity, and that identity decides the blast radius. In the Hugging Face case, environment-variable secrets, service-account tokens and metadata credentials turned code execution in one pod into access across clusters. Give each sandbox or worker its own short-lived, narrowly scoped workload identity, keep secrets out of environment variables that child processes inherit, and never let a code tool run with a developer's full cloud profile. See Runtime Secrets Injection for AI Agents Without Prompt Exposure and the Cloud Instance Metadata Services Compared Guide.

Choosing a control model

Situation	Preferred control	Trade-off
Chat feature that analyses user files	Managed, ephemeral sandbox per session, no network, no credentials	Some analysis libraries unavailable
Coding agent on developer laptops	Agent in a dev container or VM with project-only mounts and approval for commands	More friction; developers may seek workarounds unless the container is fast
Autonomous DevOps or SRE agent	Typed tools for each operation, no free shell, change approval for destructive actions	Slower to add new capabilities
Shared notebook platform	Per-user kernels with per-user identity, authorisation enabled, no shared service credentials	Operational cost of per-user isolation
Data or evaluation pipeline	Configuration parsed as data only, worker pods without secrets or metadata access, egress blocked	Some dynamic features must be removed

Small teams can get most of the benefit by using a managed sandbox service and removing free shells; large organisations should add central tool-call logging and a review gate for any new execution-capable tool.

How to test

Find the sinks: search AI application code for eval, exec, subprocess calls, template rendering of untrusted fields and framework code utilities; list each with its owner.
Authorised injection test: in a test environment, feed the agent benign content asking it to run a harmless marker command, and confirm the sandbox or approval gate stops or contains it.
Escape checks: from inside the sandbox, confirm there are no host mounts, no credentials in the environment, no metadata access and no unapproved egress.
Detection check: trigger an expected shell spawn from an agent process in the lab and confirm the alert reaches the on-call team at the right severity.
Regression: keep these tests in CI so framework upgrades and new tools are re-checked. See the AI Agent Security Testing Checklist.

Rolling it out

Inventory: list every agent, plugin, notebook platform and pipeline that can run code, and the identity each runs as.
Remove: retire unused code tools and framework helpers; replace free shells with typed tools where the use case allows.
Isolate: move remaining execution into sandboxes, starting with anything that processes external content.
Strip credentials: remove secrets from sandbox and worker environments and block metadata access.
Audit, then enforce: run egress and approval rules in log-only mode for a pilot group, then enforce.
Roll back safely: if a sandbox breaks a workflow, widen the specific allowlist entry rather than returning execution to the host.

Common failure patterns

Trusting the model to refuse: relying on system prompt instructions instead of a sandbox to stop harmful commands.
Blocklist validators: filtering dangerous names in generated expressions, the pattern behind the Semantic Kernel issue.
Sandbox with secrets inside: isolated execution that still inherits cloud keys or tokens through environment variables.
Open egress from workers: code execution in a pod becomes exfiltration and command and control within minutes.
Exposed notebook or harness endpoints: code execution services reachable without strong authentication, as with the evaluation harness in the Hugging Face case.
Agent instructions shipped without review: prompt and configuration changes released through pipelines that do not treat them as code.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS	AML.T0050 (AML.TA0005 Execution); related AML.T0051, AML.T0053, AML.T0011.000 Unsafe AI Artifacts	Technique and the steps that usually precede it
MITRE ATLAS mitigations	AML.M0011 (linked); AML.M0024, AML.M0028, AML.M0029, AML.M0030, AML.M0032, AML.M0033	Library restriction, telemetry, tool permissions, approval, segmentation, validation
MITRE ATT&CK	T1059; T1059.001 PowerShell, T1059.004 Unix Shell, T1059.006 Python, T1059.007 JavaScript	Enterprise equivalent
OWASP Top 10 for LLM Applications 2025	LLM05 Improper Output Handling, LLM06 Excessive Agency	Model output reaching shells, `exec` or `eval`; unneeded tool functions
OWASP Top 10 for Agentic Applications	ASI05 Unexpected Code Execution (RCE), ASI02 Tool Misuse and Exploitation	Agent-generated code and tool abuse
NIST SP 800-53 Rev. 5	CM-7, SC-39, SC-7, SI-10, SI-4	Least functionality, process isolation, boundary protection, input validation, monitoring
NIST CSF 2.0	PR.PS-05, DE.CM-09	Unauthorised execution prevented, runtime monitoring
MITRE D3FEND	D3-PSA, D3-SCA, D3-EAL	Process spawn analysis, system call analysis, executable allowlisting

Practitioner checklist

Inventory every AI component that can run code and the identity it runs as.
Remove free shells and unused framework code utilities; prefer typed tools.
Eliminate eval, exec and template rendering of model output or untrusted configuration.
Run remaining code execution in sandboxes with no host mounts and no ambient credentials.
Default-deny egress and block metadata access from sandboxes and workers.
Require approval with the full command for execution after untrusted input.
Alert on shells spawned by agent, notebook and model-serving processes, at a severity that pages someone.
Keep notebook servers authenticated, with authorisation enabled on shared platforms.
Track and apply agent framework security releases quickly.
On any hit, treat the host as compromised and rotate reachable credentials.

AML.T0050 Command and Scripting Interpreter: Constraining Code Execution by AI Agents