A few weeks ago I gave an LLM-driven coding agent the ability to run shell commands on a scratch server, and within ten minutes of unconstrained experimentation it tried to curl a metadata endpoint, write outside its working directory, and read my shell history file. None of that was malicious — the model was just being helpful in the broadest possible sense of "helpful." But it made something click for me: we keep debating prompt injection as a text problem while handing agents filesystem and network access as a systems problem.
This article is about the systems problem. Specifically: a small, reproducible harness that lets you observe and assert what a tool-calling agent actually does at the syscall level, before you ever let it near anything you care about. Everything below runs on a modest Linux box — I used a free cloud server, which is exactly the right place for this kind of adversarial experiment because it's disposable.
The mistake: trusting the agent's description of its own behavior
When an agent says "I'll just read the config file," that sentence is a claim, not a fact. The tool-call layer is where claims become syscalls, and there's often a gap:
The agent summarizes intent ("checking the environment") but the actual command is env | base64.
