Executive brief
SafeInstall is a security tool used to monitor and restrict the actions of AI coding agents to prevent them from running malicious commands. A flaw in how the tool reads shell commands allows an attacker to trick an AI agent into running dangerous package installations that bypass security checks. If exploited, an attacker could gain full access to a developer's source code, credentials, and local files.
Technical details
A protection mechanism failure (CWE-693) and improper case sensitivity handling (CWE-178) exist in the SafeInstall agent guard's shell parsing logic. The parser fails to recognize package-manager commands when they use case-variant launcher names, leading file-descriptor redirections, or specific shell wrapper options. An attacker can craft instructions that influence a coding agent to issue these malformed commands, bypassing the guard's policy evaluation and lifecycle script enforcement. This allows for the execution of arbitrary registry-provided code with the permissions of the developer's environment. The issue is fixed in version 0.10.2 through improved command normalization and stricter parsing of redirections and wrappers.
Affected products
- Mickdownunder/SafeInstall safeinstall-cli <= 0.10.1
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: Fixed in version 0.10.2