How to Prevent LLM Agents from Accidentally Deleting Files with AST Analysis

LLM agents executing shell commands resemble a high-stakes game where a single mistake can lead to significant data loss or system damage. Demonstrations have shown agents unintentionally substituting file paths, resulting in critical files being deleted or destructive commands like rm -rf / being executed. The issue extends beyond flawed instructions; standard text checks fail to assess the actual consequences of a command prior to execution.

To enhance security, I've been exploring a combination of Abstract Syntax Tree (AST) parsing and a safety-oriented subagent. This approach involves dissecting commands into their fundamental elements to evaluate their effects on the system, rather than relying on an LLM's simple safety assessment.

Designing a More Secure Shell Agent

This design transitions from a single, high-risk execution loop to a multi-layered validation process. A high-reliability setup should operate as follows:

1. Command Creation: An LLM agent formulates a shell command from a natural language request.
2. AST Parsing: Before executing the command, it undergoes AST parsing to identify high-risk elements such as redirection symbols (>), destructive flags (-r, --force), or ambiguous environment variable substitutions.
3. Subagent Review: The parsed command structure—not just the raw text—is sent to a specialized "Security Subagent," which focuses on detecting hidden risks within the command's structure.
4. Execution or Halt: If the subagent identifies high-risk patterns (e.g., a sudo command targeting system directories), execution halts and awaits human approval.

Why AST Parsing Outperforms Regex

Conventional "safe" AI agents use regex patterns to detect keywords like rm or chmod. However, this method can be circumvented through minor modifications or complex command chaining. AST parsing analyzes the actual decision logic of the command. For instance, consider the agent-generated command:

find . -name "*.log" -exec rm {} \;

Regex might overlook the danger if the pattern is slightly altered. AST parsing, however, recognizes find, the exec action, and the rm subcommand as a unified destructive sequence, understanding the command's true intent rather than just its appearance.

Implementing Basic Validation

Building an AI-driven shell workflow does not require an extensive model. A lightweight, efficient model like a Llama fine-tune or a structured prompt in Claude suffices for the subagent role. A potential structure for the subagent's prompt in a practical scenario is:

{
  "task": "Shell Command Security Check",
  "input": {
    "command": "rm -rf ./tmp/ old_logs",
    "parsed_structure": {
      "action": "remove",
      "targets": ["directory", "./tmp/"], ["file", "old_logs"],
      "flags": ["-r", "-f"],
      "scope": "relative_path"
    }
  },
  "guidelines": "Evaluate if the 'scope' might escalate to system directories or if 'flags' indicate irreversible actions without user confirmation."
}

By forcing the agent to reason from the parsed structure rather than the raw string, misinterpretation risks are reduced. The subagent assesses a clear breakdown of the command's objectives, transforming the execution process into a verifiable, step-by-step procedure for autonomous systems.

For AI agents to securely manage credentials, a system like Secure credential delegation provides a robust solution. This system allows agents to access APIs without exposing sensitive credentials. Users grant precise access permissions, determining what information to share and can revoke it at any time. The process involves replacing hard-coded credentials with template variables such as {{OAUTH2_ACCESS_TOKEN}} or {{STRIPE_PRIVATE_KEY}} using keychains as a drop-in replacement for curl. When a new API scope is required, the user reviews the agent's intended actions and approves with a single click. Credentials are then securely injected server-side, ensuring the agent receives exactly the access it needs without unnecessary privileges.