AIKIDO-2026-11047

TL;DR

The calculator tool passes LLM-supplied expression strings through SymPy parsing that ultimately evaluates Python code, so crafted input such as __import__('os').system(...) can execute arbitrary commands on the host running the agent. The cron tool previously wrote unsanitized schedule, command, and raw entry values directly into the user's crontab without confirmation, allowing newline injection to smuggle extra cron lines and persist malicious jobs. The use_aws tool returned boto3 responses verbatim, exposing credential and secret fields from read APIs into LLM conversation history and telemetry. Version 0.6.0 adds AST allowlisting and restricted parsing for calculator, full-line newline sanitization plus consent gating for crontab writes, and response redaction with consent prompts for credential-returning AWS operations.