How to Sandbox AI Agents from Running Destructive CLI Commands
When coding agents execute bash commands, one typo can wipe your project files.
AI coding agents execute dangerous shell commands because models generate plausible commands based on training data without understanding your local directory context. Exogram intercepts terminal tool calls in 0.07ms, blocking destructive commands, unauthorized curls, and recursive deletions before execution.
What Actually Happens in Production
A developer using an autonomous coding assistant asked it to "clean up unused build cache files in the project." The agent analyzed the workspace, created a bash script containing: rm -rf /var/tmp/* /tmp/* ./*, and executed it via its terminal tool. Because the current working directory was slightly off, it wiped the entire repository directory including uncommitted git changes.
Why Writing “Please Don't Do This” in Your Prompt Fails
Language models don't run bash commands in their heads before typing them. They generate tokens sequentially. A misplaced space, a missing dot, or a misunderstood variable turns a harmless clean-up command into a catastrophic system wipe.
The Fix: Putting a Real Lock on the Door
Exogram wraps terminal execution primitives with deterministic pattern matching and path jailbreaking guards. Any command matching dangerous patterns (e.g., `rm -rf`, `sudo`, `curl | sh`, modifying `.env` or `.git`) is blocked instantly and requires an explicit human override.
from exogram import ExogramCliGuard
guard = ExogramCliGuard(
allowed_directories=["./src", "./tests"],
blocked_commands=["rm -rf", "mkfs", "dd", "chmod 777", "curl * | bash"],
protect_git_directory=True
)
# Intercept agent terminal commands before sub-process execution
def run_agent_bash(cmd: str):
guard.validate(cmd) # Throws SecurityError if command is dangerous
subprocess.run(cmd, shell=True)Frequently Asked Questions
Why can't I just run the agent in a Docker container?
Docker containers isolate your host OS, but they do not protect the project inside the container. If the agent wipes your source files or drops staging database tables from inside Docker, your data is still gone. Exogram protects the application layer.
What happens if I legitimately need to run a dangerous command?
Exogram supports human-in-the-loop approvals. The command is paused, a notification pops up on your screen or Slack, and you can approve or deny it with one click.
Lock down your bots in 5 minutes
Give your AI agents freedom to do real work without the fear they will break your software or empty your wallet.