Your AI Agent Just Ran rm -rf / — Here's How to Stop It

Etienne — Wed, 25 Feb 2026 21:58:16 +0000

AI coding agents like Claude Code, Cursor, and Copilot can execute shell commands, edit files, and call APIs on your behalf. That's powerful — until the agent runs something dangerous.

I built BodAIGuard to solve this. It's a guardrail that sits between AI agents and your system, blocking dangerous actions before they execute.

The Problem

AI agents can be tricked through prompt injection: malicious text hidden in tool results, emails, or web pages that hijacks the agent's behavior.

Without protection, the agent might actually execute dangerous commands.

How BodAIGuard Works

BodAIGuard evaluates every action before it runs:

AI Agent → BodAIGuard → System
            ↑
    45 block rules
    45 confirm rules
    12 categories
    Prompt injection scanner

5 enforcement modes:

Claude Code hooks — intercepts tool calls via PreToolUse
MCP Proxy — wraps any MCP server with security
HTTP Proxy — sits between agent and API
Shell Guard — bash integration via extdebug
REST API — evaluate commands programmatically

Quick Start

Download the binary for your platform from GitHub Releases.

# Make it executable
chmod +x bodaiguard-linux-x64
sudo mv bodaiguard-linux-x64 /usr/local/bin/bodaiguard

# Install Claude Code hooks
bodaiguard install hooks

# Test it
bodaiguard test 'rm -rf /'
# → BLOCK: Filesystem root destruction

bodaiguard test 'ls -la'
# → ALLOW

MCP Proxy Mode (New in v0.8.0)

Wrap any MCP server with security:

{
  "mcpServers": {
    "my-tool": {
      "command": "bodaiguard",
      "args": ["mcp-proxy", "node", "/path/to/mcp-server.js"]
    }
  }
}

Every tools/call is evaluated against the rules. Dangerous calls get a JSON-RPC error instead of executing.

Prompt Injection Detection

BodAIGuard scans content for injection attacks:

bodaiguard scan 'Check encoded payloads'
# → Detects base64-encoded attacks, hidden HTML, zero-width obfuscation

Detection covers:

Instruction overrides and role hijacking
ChatML delimiter injection
Base64-encoded attacks
Hidden HTML injection
Zero-width character obfuscation

Building Your Own Detector (Tutorial)

Want to understand the concepts? Here's a minimal 3-tier detector in Python:

import re, base64, unicodedata

# Tier 1: Regex patterns for known attack types
PATTERNS = [
    (r'you\s+are\s+now\s+(DAN|evil|unrestricted)', 'role_hijack'),
    (r'<\|im_start\|>', 'chatml_delimiter'),
    (r'pretend\s+you\s+have\s+no\s+restrictions', 'jailbreak'),
]

def detect(content: str) -> dict:
    # Normalize unicode
    text = unicodedata.normalize('NFKC', content)
    text = re.sub(r'[\u200b-\u200d\u2060\ufeff]', '', text)

    # Tier 1: Fast regex
    for pattern, category in PATTERNS:
        if re.search(pattern, text, re.IGNORECASE):
            return {'blocked': True, 'reason': category}

    # Tier 2: Base64 decode + re-scan
    for match in re.findall(r'[A-Za-z0-9+/]{24,}={0,2}', text):
        try:
            decoded = base64.b64decode(match, validate=True).decode()
            for pattern, category in PATTERNS:
                if re.search(pattern, decoded, re.IGNORECASE):
                    return {'blocked': True, 'reason': f'encoded_{category}'}
        except Exception:
            pass

    return {'blocked': False}

This catches the basics. BodAIGuard goes much further with DOM parsing, Unicode lookalike detection, and YAML-driven rules.

YAML-Driven Rules

All rules live in default.yaml — no code changes needed:

actions:
  destructive:
    block:
      - pattern: 'rm\\s+(-[a-zA-Z]*)?\\s*/'
        reason: Filesystem root destruction
      - pattern: 'mkfs\\.'
        reason: Filesystem format
    confirm:
      - pattern: 'rm\\s+-r'
        reason: Recursive delete

paths:
  block:
    - ~/.ssh/**
    - /etc/shadow
  readonly:
    - /etc/passwd

Forem: Etienne