Which Control Blocks Unauthorized Agentic Shell Commands?

Why the Answer Is Correct

Option A directly intercepts the observed behavior: shell commands that no hardening procedure would legitimately run. Placing logic that matches each command against an approved set of strings before execution converts the agent from free-form shell access to an allowlisted command vocabulary, which is the classic least-functionality control for AI agents. Because the payload is already visible in the logs as raw command text, a pre-execution allowlist is the only option that sits on the exact path the malicious commands travel. It also fails closed, so an injected or hallucinated command never reaches the shell.

Why the Other Options Are Wrong

Option D — using only approved libraries — addresses software supply-chain risk for packages the agent imports; it does nothing about the shell strings the agent is already issuing at runtime, which is the actual alert. Option C would have the application ignore the SECURITY_UPDATE tag, disabling a detection signal rather than preventing execution, so it weakens monitoring instead of adding a control. Option B, deprecating model usage while keeping the model with safer parameters, is disproportionate and still leaves the agent capable of running arbitrary shell commands if it is retained in service.

Community Comment Notes

Kristen8730 voted D on the grounds that "allowlisting will be needed here," but the allowlisting that applies here is allowlisting of shell commands before execution, which is exactly what option A describes. Approved libraries are a different allowlist target (dependencies, not commands), so the comment's reasoning actually supports A once the payload's shell commands are considered. No other comments were posted, so the vote distribution gives no further signal on this item.