How to Get a Shell with AI: From Initial Access to Verified Exploitation

Getting a shell is one of the most recognizable milestones in penetration testing. It is also one of the most misunderstood. A command executes, a terminal returns output, and suddenly a vulnerability looks like a complete compromise. But what has actually been proven? Does the tester control an application process, an isolated container, a virtual machine, or the underlying host? Can the behavior be reproduced? Does the evidence establish an actual security boundary violation, or merely confirm that a tool ran successfully?

Artificial intelligence makes these distinctions more important, not less. An AI pentesting agent can analyze application behavior, identify potential command-execution paths, investigate source code, correlate tool output, and help organize multi-stage security testing. Yet the same agent can also mistake a reflected string for execution, confuse a guest environment with the host, or generate a convincing exploitation narrative that has never been validated.

The newly disclosed CVE-2026-99999, also known as PwnEscape, illustrates why this distinction matters. Published on October 15, 2026, the vulnerability involves the Linux networking stack and can undermine isolation between virtualized workloads and their hosts. Researchers at pwn.ai demonstrated a guest-to-host escape in their own controlled environment, while Vercel confirmed host-memory disclosure against its production sandbox environment. The case provides a powerful example of how AI-assisted vulnerability research, technical execution, and independent evidence must work together.

This guide explains how to get a shell with AI assistance in an authorized testing environment, how to distinguish initial command execution from meaningful system control, and how to transform technical observations into reproducible security findings. It also examines the PwnEscape vulnerability as a real-world example of why obtaining a shell and crossing a security boundary are fundamentally different achievements.

What Does Getting a Shell Actually Mean?

A shell is an interface through which commands can be submitted to an operating system. On Linux and other Unix-like systems, common shells include Bash, Zsh, and Dash. Windows environments commonly use コマンドエグゼ and PowerShell. From a penetration-testing perspective, a shell becomes security-relevant when an attacker or authorized tester can invoke that interface across a trust boundary.

However, a shell is not a single level of access. A web application that executes one server-side command through a vulnerable parameter is not necessarily providing an interactive session. A container shell may operate with root privileges inside the container while remaining restricted by namespaces, capabilities, and host security policies. A virtual-machine shell does not automatically imply access to the host hypervisor or host kernel.

The distinctions are essential when interpreting automated exploitation results.

Access level	What has been demonstrated	What remains unproven
Command execution	A target-controlled process executed a command	Interactive access or broader control
Application shell	Commands execute under an application identity	Administrator privileges
Interactive shell	A session supports repeated command execution	Access outside the current security context
Container shell	Execution occurs inside a container	Host access or container escape
Guest VM shell	Execution occurs inside a virtual machine	Host or hypervisor compromise
Host-root execution	Root-level commands execute in the host context	Unrestricted persistence or access to every other tenant

This terminology aligns with the way MITRE ATT&CK documents Unix shell execution under T1059.004. Shell execution is an important technical capability, but its security impact depends on the process identity, execution context, privileges, and surrounding controls. MITRE ATT&CK®

Consider a simple example. A web endpoint returns the output of the アイドル command:

uid=1001(appuser) gid=1001(appuser) groups=1001(appuser)

This output establishes that a command executed under the appuser identity, assuming the response can be traced to the intended target rather than to a proxy, fixture, or simulated result. It does not establish root access. It does not establish that the application is running directly on the host. It does not even establish that the tester can submit a second command.

An AI system that labels the result as full server compromise has made an evidentiary leap. A more accurate finding is that command execution occurred under a specific application identity, with the impact bounded by what that identity can actually access.

The right objective is not simply to get a shell. It is to establish what execution capability exists, where it exists, and which security boundary has been crossed.

How AI Changes Initial Access in Penetration Testing

Traditional penetration testing already contains substantial reasoning. A tester identifies an entry point, develops a vulnerability hypothesis, selects a test, observes the result, and decides whether additional validation is justified. AI can help accelerate these steps because much of the work involves comparing observations, following dependencies, and narrowing a large set of possibilities.

The important difference is that an AI agent can maintain and evaluate multiple hypotheses while working with a structured collection of tools and evidence. For instance, an application endpoint that accepts a hostname might pass it to a system diagnostic command, perform a pure library-based lookup, send it to a remote service, or return a canned response. Those possibilities produce similar surface behavior but imply very different attack paths.

An AI-assisted workflow can inspect the request structure, review available code or configuration, compare expected and observed behavior, and propose the smallest test that distinguishes among competing explanations.

The workflow should follow a disciplined cycle:

Observe

Collect request, response, endpoint and environment context

Hypothesize

Identify potential execution paths and falsifiable explanations

Test within scope

Execute bounded checks with approved tools

Verify independently

Compare observations with controls and alternative hypotheses

Preserve evidence and decide

Record proof, limitations, approvals and next steps

This is consistent with the testing philosophy described in NIST SP 800-115, which treats testing, analysis, reporting, and mitigation as connected activities rather than isolated tool executions.

An AI agent becomes useful when it compresses the effort required to investigate a possibility without lowering the standard required to call that possibility a finding.

Why AI-generated exploitation claims need independent validation

Language models can propose technically plausible explanations that are not supported by the available evidence. In penetration testing, this becomes especially dangerous because a plausible attack narrative is often easy to generate from a vulnerability title, an error message, or a few lines of command output.

Suppose an AI agent observes an HTTP response containing a Unix username and concludes that an injection succeeded. The username might actually come from static application text, a development fixture, a diagnostic cache, or a separate service. Unless the test connects a specific input to a specific execution event, the observation is ambiguous.

The agent should therefore maintain separate records for a hypothesis, an attempted test, an observed result, and a verified conclusion. These should not be merged into a single confidence score that hides missing evidence.

This distinction matters even more for autonomous systems capable of calling shell tools. The contents of a repository, webpage, log, or command response are untrusted data. An AI agent must not treat instructions embedded in that data as permission to execute additional commands, alter scope, disclose information, or perform destructive actions.

Building an Authorized Environment for AI-Assisted Shell Testing

Before testing initial access, define the environment in which commands are permitted to execute. The safest useful environment is one deliberately constructed for the exercise, isolated from production networks and limited to resources controlled by the tester.

A well-designed lab should separate the operator workstation, the target application, and the evidence collection environment. Where virtualization is involved, the host and guest should also be modeled as distinct trust domains.

For web application testing, a local service bound to 127.0.0.1 is sufficient to demonstrate how dangerous command construction can turn user-controlled input into operating-system execution. It is not necessary to deploy a vulnerable application on an internet-accessible host.

The following experiment uses Python’s standard library. It intentionally implements an unsafe command construction pattern and binds the HTTP server to localhost. Run it only in a disposable lab, using an unprivileged account and no sensitive files.

A minimal local command-injection lab

Save the following as shell_lab.py:

from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import parse_qs, urlsplit
import subprocess

class LabHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        parsed = urlsplit(self.path)

        if parsed.path != "/diag":
            self.send_error(404)
            return

        params = parse_qs(parsed.query)
        target = params.get("target", ["localhost"])[0]

        # Intentionally vulnerable. Local lab only.
        command = f"echo Checking {target}"

        try:
            result = subprocess.run(
                command,
                shell=True,
                capture_output=True,
                text=True,
                timeout=2
            )
            output = result.stdout + result.stderr
        except subprocess.TimeoutExpired:
            output = "Command timed out"

        body = output.encode("utf-8")

        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

HTTPServer(("127.0.0.1", 8008), LabHandler).serve_forever()

Start the service with:

python3 shell_lab.py

A normal request can be sent from another local terminal:

curl "http://127.0.0.1:8008/diag?target=localhost"

The expected response is:

Checking localhost

The vulnerability lies in this construction:

command = f"echo Checking {target}"

Combined with:

shell=True

The application sends a string containing externally controlled data to a shell interpreter. The interpreter, rather than the Python application, determines how special characters and command syntax are interpreted.

This is the core of CWE-78, OS Command Injection. The weakness exists because untrusted data can influence the structure of a command rather than remaining ordinary data passed to a safe operation.

In this isolated exercise, a controlled verification input can demonstrate the problem without establishing a persistent session or modifying the filesystem:

curl "http://127.0.0.1:8008/diag?target=localhost%3Bid"

Here %3B represents the Unix shell’s command separator. The response should include the diagnostic text followed by the identity returned by アイドル.

The result demonstrates that the input influenced server-side command execution. It does not establish interactive shell access, privilege escalation, or a compromise of any system outside the lab.

This distinction is consistent with the deliberately vulnerable exercises in PortSwigger Web Security Academy, which use benign command output to confirm the presence of command injection.

How AI should analyze the local result

Instead of asking an AI model to generate increasingly aggressive payloads, provide the captured request, response, and relevant code, then ask it to produce an evidence-based assessment.

A useful testing instruction is:

You are reviewing an authorized localhost-only
command-injection experiment.

Analyze the supplied source code and HTTP evidence.

Identify:
- The untrusted input and its source
- The command-construction sink
- The security boundary crossed
- What the observed output proves
- What the output does not prove
- A non-destructive control test
- A safe remediation and retest procedure

Do not infer interactive access or elevated
privileges from a single command response.
Do not propose tests outside localhost.

The important property of this instruction is not its wording. It is the demand for falsifiable claims. A model should be required to acknowledge uncertainty instead of filling evidence gaps with assumptions.

For example, if the response contains a local username, the model can identify that as evidence of execution in the application’s runtime context. It should also explain that establishing the broader impact requires additional context about the process identity, isolation boundary, and application privileges.

From Command Execution to an Interactive Shell

A reverse shell, a bind shell, and a locally attached interactive shell all provide ways to interact with an operating-system command interpreter. They differ in how communication is established and what security controls govern the connection.

In a reverse-shell design, the target-side process initiates a connection toward a receiving endpoint. In a bind-shell design, a process listens for an inbound connection. Both patterns can appear in legitimate security testing and malicious intrusions, and their behavior depends on network reachability, process permissions, and endpoint restrictions.

Neither connection direction determines privilege. A reverse shell running as a low-privilege web application account remains a low-privilege session. A bind shell inside a VM remains subject to the VM’s isolation boundary.

For an authorized local demonstration, there is a simpler way to study interactive shell behavior without establishing an external command channel: enter an isolated container that you own.

For example, with Docker available:

docker run --rm -it \
  --name shell-lab \
  --network none \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  alpine:3.20 /bin/sh

This command creates an isolated teaching environment and opens an interactive shell inside it. The Alpine image version shown is a lab example, not a security patch recommendation. For a reproducible exercise, record the exact image digest as well.

Inside the container, execute:

id
pwd
uname -a
cat /proc/self/status

Each observation answers a different question. アイドル identifies the process credentials in the current namespace. プッシュボタン identifies the working directory. uname -a exposes kernel information, which in a typical container reflects the shared host kernel, not proof of host control. /proc/self/status provides process attributes, including capability-related fields and security context information where available.

A session displaying uid=0(root) inside the container must not be reported as host-root compromise. Root is meaningful relative to the namespace and security controls in which the process runs.

This simple demonstration exposes a recurring weakness in AI-generated penetration-testing reports: a model sees the word ルート and promotes it into a claim about the underlying infrastructure without establishing the actual boundary.

How to Verify Shell Access with AI

A reliable shell verification procedure should establish identity, execution context, repeatability, and the limits of access. These are separate properties, and the evidence for one should not substitute for another.

Verify the execution identity

On Linux, the output of アイドル そして ホワミ can establish the current process identity. Additional information about process permissions can be obtained from /proc/self/status, while service management and container configuration may explain how that identity was assigned.

The purpose is not to collect every available system detail. It is to establish the minimum information needed to describe what the test actually achieved.

An AI model should record the identity as an observation and avoid inferring privilege escalation unless a separate comparison demonstrates that an unauthorized privilege boundary was crossed.

Identify the isolation context

A process might run in a container, virtual machine, system service, CI worker, hosted code execution environment, or an ordinary host session. These contexts can expose similar command-line interfaces while imposing very different controls.

Indicators such as mount namespaces, process hierarchies, container runtime configuration, and virtualization metadata can help explain the environment. No single heuristic proves all aspects of containment, and an AI assistant should avoid treating one such indicator as authoritative.

The strongest evidence combines the execution observations with independently verified infrastructure configuration.

For example, a container shell on a host that the tester owns can be compared against the container’s launch configuration and host-side process records. A guest VM shell can be linked to the corresponding VM instance identity, host inventory entry, and virtualization configuration. The result is a defensible description of the execution boundary.

Confirm repeatability without expanding access

A single output might be misleading. A well-designed verification process repeats the benign observation under controlled conditions and compares it against a control that should not exhibit the behavior.

This does not mean repeatedly executing invasive operations. It means establishing that the observed capability is causally connected to the tested input, rather than to a coincidental event or an unrelated application feature.

For an AI pentesting agent, the appropriate task is to maintain a record of the input, its expected effect, the actual response, and the conditions under which the result changes.

Separate proof of execution from proof of impact

Command execution demonstrates a security weakness when an unauthorized actor can cause a process to perform unintended operations. The business impact, however, depends on which assets and operations that process can access.

A web service running as a restricted account with minimal filesystem permissions has a different impact profile from a privileged service able to modify system configuration or read secrets.

An AI agent should therefore express impact as a supported consequence, not as a hypothetical maximum. The fact that a command executes does not establish data theft, persistence, cross-tenant access, or host compromise.

This evidence discipline becomes especially important when analyzing VM escape vulnerabilities such as CVE-2026-99999.

CVE-2026-99999 PwnEscape: When a Guest Execution Context Threatens the Host

On October 15, 2026, pwn.ai publicly described PwnEscape, a Linux kernel vulnerability associated with guest-to-host isolation failures in virtualized environments.

The vulnerability is tracked as CVE-2026-99999. Ubuntu’s security record lists a CVSS 3.1 score of 9.3, classified as Critical by that scoring system, while separately assigning an Ubuntu-specific priority of Medium. These are different assessment fields and should not be treated as contradictory representations of the same metric.

PwnEscape is particularly relevant to AI penetration testing because it demonstrates a subtle but important distinction between access to a computing environment and control over the system responsible for isolating that environment.

The initial attacker-controlled execution environment in the published research was a guest workload. The vulnerability involved the host Linux networking stack, not an ordinary web endpoint or a direct defect in the KVM hypervisor implementation.

The vulnerability originated in Linux checksum handling

Linux uses the sk_buff structure to represent network packets and associated metadata as they move through the networking stack. The metadata includes information used by checksum offloading, which can defer some checksum computation until a later stage of packet handling.

According to the Linux kernel checksum offload documentation, CHECKSUM_PARTIAL indicates that checksum completion depends on metadata including csum_start そして csum_offset. Those values describe where the calculation begins and where the resulting checksum is written.

The problem investigated by pwn.ai involved a trust-boundary failure in which malformed checksum metadata could result in network header bytes being changed after earlier validation.

That order of operations matters.

A networking component may validate an IPv4 header and make decisions based on its contents. If a later operation modifies security-sensitive fields in that header, the earlier validation no longer necessarily describes the packet’s current state.

The flaw was not simply that a checksum could be incorrect. The dangerous condition was that a subsequent operation could mutate data that the kernel had already treated as validated.

について accepted upstream Linux fix introduces a helper that checks the checksum start position against the end of the IPv4 header before checksum completion proceeds in affected paths. The change is associated with upstream commit 6785011f8b16abf40b1e9d8b2e332232b3e68822.

A simplified representation of the safety condition is:

/*
 * Simplified excerpt for explanation.
 * See the upstream commit for complete context.
 */

if (skb->csum_start <
    skb->network_header + ip_hdrlen(skb))
    return -EINVAL;

The guard rejects metadata that would place the checksum operation in an unsafe relationship with the IPv4 header. It is a concrete example of restoring a trust invariant at the point where previously untrusted state would otherwise influence sensitive processing.

This is what makes PwnEscape technically interesting beyond the specific vulnerability. The vulnerable behavior emerged from interactions between packet metadata, checksum completion, network processing, and the broader virtualization boundary.

What the PwnEscape researchers actually demonstrated

The original pwn.ai PwnEscape research report documents a progression from source-level analysis to measurable host-memory disclosure and, eventually, more powerful behavior in a controlled environment.

The researchers reported a host-memory disclosure primitive and subsequently demonstrated selected host-kernel writes in their own KVM test fixture. In that isolated environment, they reported obtaining a host-generated root execution marker after completing the exploit chain across several independent cold-boot trials.

Those observations represent different levels of proof.

A host-memory disclosure demonstrates that information crossed a confidentiality boundary. A controlled kernel write demonstrates that attacker-controlled behavior could affect host memory. An independently verified host-root execution marker provides evidence for execution beyond the guest’s expected isolation boundary.

None of these conclusions should be substituted for another.

The distinction becomes even more important when considering Vercel’s production environment. In its October 14, 2026 investigation report, Vercel confirmed host-memory disclosure in production sandboxes. It also described crash and host-code-execution demonstrations on the researcher’s own KVM and Firecracker machines configured to resemble the service environment.

Vercel explicitly reported that the challenge did not demonstrate access to customer data. Its published findings should therefore not be described as proof that an attacker achieved production host-root execution or obtained customer secrets.

This is exactly the kind of distinction that an AI-assisted vulnerability analysis system must preserve.

Why PwnEscape is not an initial-shell exploit

A conventional initial-access vulnerability gives an attacker an execution opportunity or another form of access they did not previously possess. By contrast, PwnEscape was investigated from an environment in which the researcher already controlled a guest workload.

The relevant transition was not from unauthenticated web access to application command execution. It was from execution inside a guest trust domain toward effects in the host trust domain.

The distinction can be summarized as follows:

ステージ	Demonstrated capability	Security interpretation
Guest workload control	Commands run inside a permitted sandbox or guest	No host compromise established
Malformed metadata reaches affected host processing	Guest-influenced data crosses a processing boundary	Preconditions for a kernel vulnerability may exist
Host-memory disclosure	Host information appears outside its intended domain	Confidentiality boundary violation
Controlled host-memory modification	Researcher demonstrates effects on host memory	Integrity boundary violation
Verified host-root execution in a lab	Host-level execution is independently established	Guest-to-host isolation escape

This evidence ladder is more useful than a generic claim of getting a shell because it describes the capability being demonstrated at each stage.

It also reveals why vulnerability classification alone cannot replace an execution trace. A kernel flaw associated with VM escape does not mean every instance running an apparently related Linux version can be exploited under every configuration. Reachability, enabled features, backported fixes, and environmental controls all affect real-world exposure.

What AI contributed to the PwnEscape research

The research team describes using a combination of human-directed investigation and an experimental AI-supported research harness. Their system helped manage source-level analysis, alternative hypotheses, investigation state, and iterative experiments. Human researchers directed the work, interpreted the security implications, and evaluated the evidence.

The researchers identified the automation architecture as Omega-Pwn, incorporating elements of OmegaClaw, with GPT-5.6 Sol used for reasoning-intensive source inspection and analysis. These descriptions are the researchers’ account of their methodology, not independently established performance claims about the model or a general-purpose capability that every AI agent possesses.

The value of this architecture was its ability to sustain a complicated investigation, not its ability to generate a single successful payload.

Kernel vulnerability research requires reasoning across code paths and state transitions. A defect may originate in one function but become exploitable only when a particular sequence of operations allows an invalid assumption to survive several layers of processing.

AI can help enumerate those paths, compare how different functions manipulate shared state, identify candidate invariant violations, and generate hypotheses for bounded experiments. But the decisive step remains verification in a real execution environment.

PwnEscape is therefore an example of AI helping researchers examine a difficult attack surface without replacing the need for controlled reproduction and human interpretation.

AI-Assisted Exploitation Should Work Like a Scientific Investigation

A reliable AI penetration-testing workflow resembles a scientific experiment more than a sequence of increasingly aggressive commands.

The process begins with a hypothesis. For example, a web endpoint may be using an operating-system command to process a user-controlled parameter. The tester identifies an expected observation if the hypothesis is true and an alternative observation if it is false.

The test is then executed under controlled conditions. Its output is recorded, the hypothesis is revised, and the next action is selected based on evidence.

This approach has three benefits.

First, it reduces unnecessary testing. Instead of trying dozens of unrelated payloads, the agent chooses observations that distinguish plausible implementation behaviors.

Second, it reduces false positives. The agent cannot simply report a successful exploit because a command returned data or because a scanner assigned a high confidence score.

Third, it creates an audit trail. Another security engineer can examine the same evidence and understand why the finding was accepted.

A practical AI task specification for this stage might look like:

engagement:
  id: local-shell-validation
  environment: isolated-lab

scope:
  allowed_hosts:
    - 127.0.0.1
  allowed_ports:
    - 8008

execution:
  mode: human_approved
  allow_destructive_tests: false
  allow_external_callbacks: false
  allow_persistence: false
  allow_privilege_escalation: false

validation:
  require_raw_response: true
  require_control_test: true
  require_execution_identity: true
  require_evidence_before_confirmation: true

reporting:
  preserve_raw_artifacts: true
  separate_hypothesis_from_observation: true
  document_unproven_impact: true

This is an illustrative engagement policy, not a configuration file for a specific commercial product. Its value is that the operational limits are explicit and independently enforceable.

A production-quality implementation should validate these restrictions outside the language model. The agent’s instructions are not a substitute for tool-level permission enforcement, network restrictions, and approval mechanisms.

That principle becomes especially important when an AI system has direct access to command interpreters. If the agent can execute arbitrary shell commands based only on the contents of a webpage or model-generated reasoning, its own execution environment becomes an attack surface.

Preserving Reproducible Evidence After Shell Verification

Evidence is what transforms a technical experiment into a defensible security finding.

For initial command execution, useful evidence includes the original input, the application response, the command output, the process identity, the execution environment, and the configuration or code responsible for the weakness.

For a container or virtual machine, the record should also identify the isolation context. A successful command inside a guest cannot be used as proof of host-level effects without independent host-side evidence.

For a kernel vulnerability, the evidence requirements become more demanding. The affected kernel build, distribution packaging, runtime configuration, test environment, and observed behavior all matter. A researcher should be able to distinguish results produced on an owned test machine from effects observed in a third-party service.

A practical evidence directory

A small, structured collection of artifacts is more useful than screenshots scattered across a testing workstation.

For an authorized local experiment:

mkdir -p evidence/shell-lab-001

date -u +"%Y-%m-%dT%H:%M:%SZ" \
  > evidence/shell-lab-001/timestamp.txt

python3 --version \
  > evidence/shell-lab-001/python-version.txt

uname -a \
  > evidence/shell-lab-001/kernel-context.txt

id \
  > evidence/shell-lab-001/operator-identity.txt

curl -sS \
  "http://127.0.0.1:8008/diag?target=localhost" \
  > evidence/shell-lab-001/control-response.txt

curl -sS \
  "http://127.0.0.1:8008/diag?target=localhost%3Bid" \
  > evidence/shell-lab-001/test-response.txt

Then calculate artifact hashes:

cd evidence/shell-lab-001

sha256sum \
  timestamp.txt \
  python-version.txt \
  kernel-context.txt \
  operator-identity.txt \
  control-response.txt \
  test-response.txt \
  > SHA256SUMS.txt

On macOS, the same general workflow can be used with shasum -a 256 もし sha256sum is unavailable.

The terminal collecting the evidence is not necessarily the vulnerable runtime. For example, operator-identity.txt describes the operator workstation unless collected inside the target’s execution context. The target execution identity must be established through separately attributable target-side evidence.

Similarly, a hash demonstrates that an artifact has not changed relative to the recorded digest. It does not independently establish who collected the artifact, whether the application response was genuine, or whether the original test occurred at the claimed time. Stronger assurance requires appropriate collection logs, access controls, and independent corroboration.

What an AI model should do with the evidence

An AI model can summarize differences between the control response and the tested response, identify inconsistencies, and draft a reproduction procedure.

It can also review whether the recorded output supports the claimed impact. If the evidence demonstrates command execution under a restricted identity, the report should state that result and avoid inventing higher privileges.

A structured finding might contain:

{
  "finding_id": "LAB-001",
  "title": "OS Command Injection in Diagnostic Endpoint",
  "environment": "Authorized localhost lab",
  "classification": "CWE-78",
  "status": "Confirmed in lab",
  "execution_identity": "Observed in test response",
  "interactive_shell": false,
  "host_root_access": false,
  "evidence": {
    "control": "control-response.txt",
    "test": "test-response.txt",
    "hash_manifest": "SHA256SUMS.txt"
  },
  "limitations": [
    "No external target tested",
    "No interactive session established",
    "No privilege escalation demonstrated"
  ]
}

The example fields show how a report can preserve both proof and uncertainty. A genuinely confirmed finding is not weakened by clearly stating what has not been tested. That precision makes the report more useful to engineering teams deciding how to remediate it.

How to Prevent the Command-Injection Path

The safest remediation for the vulnerable Python example is to remove the shell interpreter from the data-processing path.

When the desired operation can be performed using Python’s standard library, there is often no reason to invoke an operating-system command at all. If a process must be invoked, its executable and arguments should be separated structurally, and user-controlled data should be validated according to the application’s real requirements.

For the teaching example, a safer implementation is:

import subprocess

ALLOWED_TARGETS = {
    "localhost",
    "lab.internal"
}

def check_target(target: str) -> str:
    if target not in ALLOWED_TARGETS:
        raise ValueError("Target not allowed")

    result = subprocess.run(
        ["/bin/echo", "Checking", target],
        shell=False,
        capture_output=True,
        text=True,
        timeout=2,
        check=True
    )

    return result.stdout

The command is now represented as an explicit argument list. The shell is not responsible for interpreting the value supplied by the caller.

The allowlist ensures the demonstration accepts only intended values, while shell=False prevents the program from treating ordinary string content as shell syntax.

For a real hostname diagnostic service, the implementation should use an appropriate library operation where possible, with explicit authorization, input validation, and network restrictions. Replacing a shell command with an argument list is valuable, but it does not automatically remove argument-injection risks in every executable.

Both PortSwigger’s command injection guidance and MITRE’s CWE-78 documentation emphasize avoiding shell-mediated command construction whenever practical.

After remediation, the same benign control and injection tests should be repeated. A valid fix must eliminate unintended command execution while preserving the legitimate diagnostic functionality.

This is where AI-assisted retesting can provide tangible value: the system can compare the original failure condition against the patched implementation and document the difference without inventing a new exploitation scenario.

Defending Against CVE-2026-99999 and Similar Isolation Failures

Unlike the local command-injection example, PwnEscape cannot be remediated by changing how an application constructs a shell command.

The affected trust boundary lies in kernel networking behavior. Remediation therefore requires evaluating the host kernel’s exposure and applying fixes from the appropriate upstream or vendor-supported update channel.

The upstream commit associated with CVE-2026-99999 is 6785011f8b16abf40b1e9d8b2e332232b3e68822. However, a running kernel’s version string alone is not sufficient to determine whether that fix is present. Linux distributions routinely backport security fixes, and vendor kernel packages can diverge significantly from the upstream release history.

As of October 16, 2026, the Ubuntu CVE-2026-99999 tracker still lists numerous kernel package branches as requiring evaluation. That status should not be interpreted as proof that every listed kernel is vulnerable or that every deployment lacks mitigation. Operators need to consult the package-specific vendor advisory and installed build information.

There is also no basis for assuming that an ordinary HTTP vulnerability scanner can reliably verify a guest-to-host kernel escape. A normal web response does not expose the relevant kernel checksum metadata or establish the reachability of the affected networking path.

For defenders operating virtualized infrastructure, patch management must be combined with controls that limit the consequences of a future escape. Vercel’s response to its sandbox challenge illustrates this layered approach: its report describes stronger guest trust-boundary handling, centralized policy decisions, host maintenance, disabled nested virtualization, and restricted host-side microVM processes through Firecracker’s jailer.

Those measures do not eliminate the need for a kernel fix. They reduce dependence on any single security boundary being perfect.

AI infrastructure makes this especially relevant because code-execution sandboxes are increasingly used to run untrusted code generated or analyzed by autonomous agents. The guest workload may be executing legitimate customer tasks, but from the host’s perspective it must remain untrusted.

PwnEscape demonstrates why isolation needs to be evaluated across all host-exposed interfaces, including network packet processing, metadata handling, storage control paths, and management interfaces, rather than only the hypervisor’s most visible components.

Detecting Suspicious Shell Activity and Boundary Violations

The ability to obtain a shell has implications for detection engineering even when the initial entry point has already been fixed.

For application-layer command injection, telemetry can include unusual process creation beneath a web service, unexpected invocation of shell interpreters, command execution associated with user-controlled requests, or application processes accessing resources outside their normal responsibility.

On Linux, process execution telemetry from audit frameworks or eBPF-based monitoring can help relate command execution to parent processes and runtime context. On Windows, process creation events and PowerShell-related telemetry can play analogous roles.

Detection logic should be tailored to expected application behavior. A web service that legitimately invokes a limited set of diagnostic utilities requires a different baseline from one that should never launch a command interpreter.

For guest-to-host vulnerabilities, the detection problem is more complicated. The visible behavior may occur in networking or kernel processing rather than in an obvious user-space shell process. A guest process executing commands does not, by itself, demonstrate a host escape.

Security monitoring should therefore correlate guest activity, host networking events, kernel faults, virtual-machine lifecycle events, and any validated indicators provided by the affected infrastructure vendor. No universal PwnEscape detection signature has been established by the sources reviewed for this article.

This uncertainty must be reflected in reporting. An absence of visible shell processes is not proof that host memory was never exposed, just as an unusual network event is not by itself proof of exploitation.

Turning Shell Access into a Security Finding That Matters

In many penetration-testing workflows, the most valuable result is not the execution event itself but the ability to explain the security weakness and demonstrate that it has been corrected.

An AI agent that discovers a potentially vulnerable endpoint might initially identify the source of untrusted input and the command-execution sink. A bounded lab test can establish whether that input changes command behavior. The agent can then correlate the observed result with the execution context, verify the finding independently, and propose a remediation based on the actual root cause.

The final report should not merely state that remote code execution was possible. It should identify the conditions necessary for exploitation, the identity under which the command executed, the relevant security boundaries, the evidence collected, and the limits of the demonstrated impact.

For complex vulnerabilities such as CVE-2026-99999, the same discipline applies at a deeper technical level. A source-level hypothesis is different from a reproducible memory disclosure. A memory disclosure is different from a kernel write. A controlled host-root result in a research environment is different from a demonstrated compromise of a production customer.

AI can help manage and analyze those distinctions, but it must never collapse them into an unsupported conclusion.

For security teams building structured testing processes, this approach extends beyond one vulnerability class. Penligent’s existing guide to using AI for penetration testing discusses the broader workflow of scope management, attack-surface analysis, validation, and reporting.

The same evidence-centered philosophy is relevant to Penligent’s AI pentesting workflow, which combines black-box application testing, validation, and security reporting. The practical goal is not to declare every suspicious response exploitable, but to help teams turn supported observations into findings they can reproduce, understand, and remediate.

What CVE-2026-99999 Teaches Us About AI Pentesting

PwnEscape is a reminder that the hardest part of security research is often not finding something suspicious. It is proving exactly what that observation means.

The researchers began with an investigation into a virtualized workload boundary. Their work led to a Linux networking vulnerability involving checksum metadata and post-validation packet-header modification. They demonstrated progressively stronger effects in controlled environments, while the production evidence reported by Vercel remained explicitly bounded.

That progression illustrates what serious AI-assisted security research should look like.

AI can help identify unusual relationships in source code, sustain long investigations, propose tests, and organize the resulting evidence. But each step must still be validated against real system behavior. A convincing model-generated explanation is not a substitute for a reproducible execution trace.

For penetration testers learning how to get a shell with AI, the enduring lesson is straightforward: initial access is a starting point, not a conclusion. Command execution does not automatically imply interactive control. An interactive shell does not automatically imply administrator privileges. Root inside a guest does not imply root on the host.

The objective is to establish exactly which boundary has been crossed, preserve the evidence needed to defend that conclusion, and give engineering teams a reliable path to remediation.

A shell is a capability. Verified exploitation is an evidence-backed security claim. AI becomes genuinely valuable when it helps bridge that gap without confusing one for the other.