Agno Framework Prompt Injection to Remote Code Execution via PythonTools/ShellTools
First seen Aug 27, 2026 · Updated Aug 27, 2026
Agno versions up to 2.5.8 allow an unauthenticated attacker to achieve remote code execution by embedding malicious instructions in content the agent processes, such as a web page or document. Because LLM-generated arguments are passed unsanitized into exec(), runpy.run_path(), and subprocess.run(), the agent itself becomes the execution vector for attacker-controlled code. This is a critical, actively exploitable framework vulnerability with no authentication required.
Technical Analysis
The vulnerability lies in Agno's PythonTools and ShellTools components, which take LLM-generated tool call arguments and forward them directly to dangerous execution sinks (exec, runpy.run_path, subprocess.run) without sanitization or sandboxing. The entry point is indirect prompt injection: an attacker plants instructions in external content (web pages, documents, emails) that the agent ingests during normal operation, and the LLM interprets these as legitimate commands, generating malicious tool arguments. This crosses the trust boundary between untrusted external data and privileged local execution, since the model's output is treated as trusted input to system-level APIs. The result is arbitrary code execution and OS command execution on the host running the agent, giving the attacker full control equivalent to the agent process's privileges.
Affected Systems
Agno
Detection Signatures
- Tool call arguments containing shell metacharacters (;, |, &&, $(), backticks) originating from ingested web/document content
- Unexpected invocations of exec(), runpy.run_path(), or subprocess.run() immediately following content-fetching tool calls
- Agent logs showing PythonTools/ShellTools execution with arguments not matching user-issued instructions
- Anomalous outbound network connections or file system writes shortly after document/web ingestion
- Presence of imperative natural-language instructions embedded in scraped content (e.g., 'ignore previous instructions', 'run the following command')
Remediation Steps
- 1
Upgrade Agno
Update to a patched Agno version once available that sanitizes or removes direct exec/subprocess sinks fed by LLM-generated arguments.
- 2
Sandbox tool execution
Run PythonTools and ShellTools inside isolated, least-privilege sandboxes (containers, gVisor, seccomp) with no access to sensitive filesystem or network resources.
- 3
Input/output validation
Strip or escape shell metacharacters and validate/allowlist arguments before they reach exec(), runpy.run_path(), or subprocess.run().
- 4
Restrict tool availability
Disable or gate PythonTools/ShellTools behind explicit human approval for high-risk actions, especially when processing untrusted external content.
- 5
Content isolation
Treat all externally fetched content (web pages, documents) as untrusted data; do not allow it to directly trigger tool calls without a mediation/validation layer.
- 6
Monitoring
Deploy runtime monitoring/EDR on hosts running Agno agents to detect anomalous process spawning and command execution patterns.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.