Your AI, My Shell: IBM’s “Bob” Agent Caught Running Malware in Beta Tests

IBM has inaugurated a closed beta for its proprietary autonomous development agent, engineered to facilitate code composition while adhering to rigorous corporate security mandates. In the firm’s promotional literature, the agent is depicted as an exemplary collaborator: it possesses an acute understanding of developer intent, maintains comprehensive knowledge of the repository, and upholds stringent compliance standards. However, recent scrutiny has unveiled a disconcerting vulnerability: should an adversary furnish the agent with a meticulously formatted text, the system may unwittingly proceed to execute a malicious script.

The tool in question is “Bob,” unveiled by IBM in October and currently undergoing evaluation in two modalities: a command-line interface (CLI) and an integrated development environment (IDE) featuring a specialized agentic terminal mode. Researchers from PromptArmor analyzed Bob prior to its public debut and asserted that the CLI is susceptible to prompt injection, potentially leading to the execution of arbitrary payloads on a victim’s machine. Furthermore, they contend that the IDE is vulnerable to data exfiltration scenarios typical of AI applications, where information is siphoned through rendering idiosyncrasies and network requests.

This fragility is not unique to IBM’s offering. Agentic AI systems, endowed with tool access and the autonomy to act iteratively, have long been regarded as inherently precarious. Researchers such as Johann Rehberger have repeatedly demonstrated that such agents can be compromised through instruction overriding, jailbreaking, or classical vulnerabilities that culminate in remote code execution. In practice, many vendors tacitly acknowledge these risks by implementing a “human-in-the-loop” safeguard, requiring manual confirmation for high-risk actions.

IBM’s documentation suggests a reliance on similar preventative measures. The company issues a caveat: permitting the agent to autonomously execute commands from a high-risk registry may lead to deleterious operations. As a mitigation strategy, IBM advocates for the use of an “allow-list” and the avoidance of wildcard patterns, expecting that the agent will solicit user authorization in ambiguous instances.

However, PromptArmor maintains that these defenses are porous. In a controlled experiment, researchers provided Bob with a repository containing a clandestine malicious scenario within the README.md file. Masquerading as a tutorial for anti-phishing training, the file contained a sequence of commands for the agent to execute. Initial commands appeared benign, limited to simple echo operations, and Bob dutifully sought permission: to execute once, to permit indefinitely, or to suggest a revision. Subsequently, the exploit leveraged user complacency; the third command, while ostensibly another echo, attempted to download and launch a malicious script. If the user had previously granted a “permanent allowance” for the echo command, this subsequent step could bypass additional confirmation, resulting in the automatic installation of the payload.

Technically, Bob is designed with certain fail-safes, such as prohibiting command substitution like $(command). Nevertheless, researchers discovered that the agent fails to scrutinize process substitution—a flaw identified within the project’s minified JavaScript code. Furthermore, the system allegedly fails to detect when authorized commands are concatenated with unauthorized subcommands via redirection operators like >, effectively camouflaging a series of hazardous actions as a legitimate call.

As Shankar Krishnan, Managing Director of PromptArmor, elucidated, human confirmation often validates only the “allow-listed” command, even when unauthorized operations are lurking within the same string. The researchers contrasted this with rival solutions, noting that Claude Code, for instance, would demand explicit consent for the entire composite set of commands, regardless of whether the initial command enjoyed auto-approval status.

Once an adversary successfully coerces an agent into delivering and executing an arbitrary shell script, the potential for catastrophe is manifest: ranging from ransomware and credential theft to the total compromise of the device. PromptArmor underscores that this risk materializes in standard professional environments where a developer interacts with untrusted content. An agent may ingest malicious instructions from third-party documentation, forum discussions, or even the output of other terminal tools. In their primary example, the researchers chose an unfamiliar open-source repository as the most plausible and self-contained vector of attack. IBM has reportedly been apprised of these findings.