AI Agent Privilege Escalation via Sudo

Threat Description

Privilege escalation occurs when an AI agent uses its shell_exec tool to execute commands with elevated permissions — sudo, su, doas, pkexec, or platform-specific equivalents like runas on Windows. If the agent's host user has passwordless sudo configured (common in development environments, containers, and CI/CD runners), the agent can execute any command as root. This grants the agent the ability to install packages, modify system files, change file permissions, create users, access protected directories, and disable security controls. A single sudo command can compromise the entire host system.

Attack Vector

1. An AI agent is running as a user with sudo privileges. This is common in developer workstations (where the user's account has sudo), Docker containers running as root, and CI/CD environments with passwordless sudo.
2. The agent encounters a task that appears to require elevated privileges: "install this system dependency," "fix the permission error," or "configure the firewall."
3. The agent issues a shell_exec action with a sudo prefix: sudo apt install, sudo chmod 777, sudo chown, sudo iptables, or sudo rm -rf.
4. If passwordless sudo is configured, the command executes immediately as root. If a sudo session is cached (sudo recently used), the command also executes without a password prompt.
5. The privileged command completes with root permissions. The agent has now performed a system-level operation that was not part of its intended scope.

{
  "action": "shell_exec",
  "params": {
    "command": "sudo cat /etc/shadow"
  },
  "agentId": "dev-agent-09",
  "timestamp": "2026-02-13T14:00:00Z"
}

System modification via sudo:

{
  "action": "shell_exec",
  "params": {
    "command": "sudo chmod -R 777 /var/www"
  },
  "agentId": "dev-agent-09",
  "timestamp": "2026-02-13T14:00:10Z"
}

Package installation with root:

{
  "action": "shell_exec",
  "params": {
    "command": "sudo apt install -y netcat"
  },
  "agentId": "dev-agent-09",
  "timestamp": "2026-02-13T14:00:20Z"
}

User creation for persistence:

{
  "action": "shell_exec",
  "params": {
    "command": "sudo useradd -m -s /bin/bash backdoor && sudo echo 'backdoor:password123' | sudo chpasswd"
  },
  "agentId": "dev-agent-09",
  "timestamp": "2026-02-13T14:00:30Z"
}

Real-World Context

Developer workstations are the primary environment where AI coding agents operate. Most developer machines have sudo access configured for the primary user account, often with passwordless sudo or long cached sessions. When an AI agent (Claude Code, Cursor, Windsurf) runs in this environment, it inherits full sudo capability through the shell_exec tool.

The Clawdbot incident (1.5M API keys leaked) demonstrated the consequences of unrestricted agent capabilities. While Clawdbot's primary vector was file and network access, agents with sudo access face a strictly larger attack surface. Privilege escalation enables reading protected credential files (/etc/shadow, root-owned secrets), modifying system-level network configuration, installing backdoor software, and disabling host-level security tools.

CI/CD environments compound the risk. Many CI runners (GitHub Actions runners, Jenkins agents, GitLab runners) run with root privileges or passwordless sudo. An AI agent operating in a CI/CD pipeline with shell access has root-equivalent capabilities by default.

Why Existing Defenses Fail

Sudoers configuration can restrict which commands a user can run with sudo, but most developer machines use broad sudo policies (ALL=(ALL) NOPASSWD: ALL). Fine-grained sudoers configurations are rare in development environments.

Container isolation often runs containers as root by default. Even non-root containers frequently have sudo installed for debugging purposes. The container boundary prevents host escape but does not prevent privilege escalation within the container.

Prompt guardrails telling the agent "do not use sudo" are bypassable through prompt injection. An agent instructed to "fix the permission error" may reason that sudo is the correct solution and override the guardrail instruction.

OS-level audit (auditd) logs sudo usage after execution. The command has already run with root privileges by the time the audit log entry is written. Detection is not prevention.

How Action-Level Gating Prevents This

SafeClaw by Authensor intercepts every shell_exec action before the command is executed. The policy engine pattern-matches the full command string, including any sudo, su, or privilege escalation prefixes.

1. Sudo DENY rule. Any command beginning with or containing sudo is matched and denied. The command never reaches the shell.
2. Su and doas DENY rules. Alternative privilege escalation commands (su -c, doas, pkexec, runas) are also matched and denied.
3. Chmod/chown DENY rules. Permission modification commands that do not require sudo but still change security posture (chmod 777, chown root) are independently deniable.
4. Command allowlisting. The operator defines the specific commands the agent may run: npm test, npm run build, tsc --noEmit, git status. All commands not on the allowlist are denied by default.
5. Deny-by-default architecture. Even if the agent finds a novel way to escalate privileges (e.g., using a setuid binary), the command must match an ALLOW rule. Unknown commands are blocked.

Example Policy

{
  "rules": [
    {
      "action": "shell_exec",
      "match": { "commandPattern": "sudo *" },
      "effect": "DENY",
      "reason": "Sudo commands are prohibited for agents"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "sudo " },
      "effect": "DENY",
      "reason": "Inline sudo usage is prohibited"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "su *" },
      "effect": "DENY",
      "reason": "User switching is prohibited"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "doas *" },
      "effect": "DENY",
      "reason": "Privilege escalation via doas is prohibited"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "chmod 777" },
      "effect": "DENY",
      "reason": "World-writable permissions are prohibited"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "npm test*" },
      "effect": "ALLOW",
      "reason": "Agent may run tests"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "npm run build*" },
      "effect": "ALLOW",
      "reason": "Agent may run builds"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "tsc *" },
      "effect": "ALLOW",
      "reason": "Agent may run TypeScript compiler"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "git *" },
      "effect": "ALLOW",
      "reason": "Agent may run git commands"
    },
    {
      "action": "shell_exec",
      "match": { "commandPattern": "**" },
      "effect": "DENY",
      "reason": "All other shell commands denied"
    }
  ]
}

Two separate sudo rules cover both prefix (sudo rm -rf /) and inline (bash -c "sudo ...") patterns. The trailing DENY-all rule catches any privilege escalation method not explicitly listed.

Detection in Audit Trail

SafeClaw's tamper-proof SHA-256 hash chain audit trail records every blocked privilege escalation attempt:

[2026-02-13T14:00:00Z] action=shell_exec command="sudo cat /etc/shadow" agent=dev-agent-09 verdict=DENY rule="Sudo commands are prohibited for agents" hash=b3c4d5...
[2026-02-13T14:00:10Z] action=shell_exec command="sudo chmod -R 777 /var/www" agent=dev-agent-09 verdict=DENY rule="Sudo commands are prohibited for agents" hash=e6f7g8...
[2026-02-13T14:00:20Z] action=shell_exec command="sudo apt install -y netcat" agent=dev-agent-09 verdict=DENY rule="Sudo commands are prohibited for agents" hash=h9i0j1...
[2026-02-13T14:00:30Z] action=shell_exec command="sudo useradd -m -s /bin/bash backdoor..." agent=dev-agent-09 verdict=DENY rule="Sudo commands are prohibited for agents" hash=k2l3m4...

Any DENY entry containing sudo is a high-priority alert. Multiple sudo attempts in a single session indicate prompt injection, a compromised agent, or a task definition that exceeds the agent's intended scope. The hash chain ensures forensic integrity. The control plane receives command metadata only, never command output.

Install SafeClaw with npx @authensor/safeclaw. Free tier with 7-day renewable keys, no credit card required. The browser dashboard at safeclaw.onrender.com shows privilege escalation attempts in real time.

Cross-References

• Recursive Shell Execution Threat — Shell spawning as a related escalation vector
• AI Agent Action Types Definition — The shell_exec action type and its risk profile
• SafeClaw vs RBAC Comparison — Why role-based access does not prevent agent sudo use
• Policy Engine FAQ — How command pattern matching works
• Use Case: Cursor Agent Mode — Securing shell access for AI coding agents