Is your agent's grep tool a shell command?

When you give an LLM a tool, you hand it a real function and let it choose the arguments. Those tools are everything your agent can do to a real system: read a file, write to your database, send an email, run a shell command, delete data. They are your risk surface, and most teams have never looked at it in one place.

So we did. We ran scan across a batch of popular open-source TypeScript AI agents. A few of the things it found, none of them exotic:

A coding agent whose grep and glob tools, which sound read-only, actually shell out through execSync. Its bash tool passes a model-chosen string straight to spawn. Arbitrary command execution, behind three innocuous names.

A query tool that fires an HTTP DELETE. A "query" that deletes.

A calculator that runs eval on whatever the model types, in a widely-used agent framework. Arbitrary code execution behind the friendliest name in the box.