Skip to main content

Why AI Agents Shouldn't Execute Shell Commands

by Scott Miller

  • AIAgents
  • AIGovernance
  • DevOps
  • InfrastructureAutomation
  • OpenSource
  • PlatformEngineering
  • ResourceShell

As AI becomes more involved in operating infrastructure, there's a question I believe deserves more attention:

๐’๐ก๐จ๐ฎ๐ฅ๐ ๐š๐ง ๐€๐ˆ ๐š๐ ๐ž๐ง๐ญ ๐ž๐ฑ๐ž๐œ๐ฎ๐ญ๐ž ๐ฌ๐ก๐ž๐ฅ๐ฅ ๐œ๐จ๐ฆ๐ฆ๐š๐ง๐๐ฌ ๐๐ข๐ซ๐ž๐œ๐ญ๐ฅ๐ฒ ๐š๐ ๐š๐ข๐ง๐ฌ๐ญ ๐ฉ๐ซ๐จ๐๐ฎ๐œ๐ญ๐ข๐จ๐ง?

I don't think it should. Not because AI isn't capable. Large language models are becoming remarkably good at reasoning through operational problems. The issue is the interface we've given them. Shells like Bash and PowerShell were designed for experienced humans. Their flexibility is incredibly powerful, but it also depends heavily on context, experience, and judgment.

Consider: systemctl restart nginx

An experienced administrator starts asking: โ€ข Is this production? โ€ข What depends on this service? โ€ข Is there an active incident? โ€ข Should I validate the configuration first? โ€ข What happens if the restart fails?

The shell answers none of those questions. It simply executes the command.

Many AI operational workflows effectively look like: ๐‘๐ž๐ช๐ฎ๐ž๐ฌ๐ญ โ†’ ๐€๐ˆ โ†’ ๐’๐ก๐ž๐ฅ๐ฅ ๐‚๐จ๐ฆ๐ฆ๐š๐ง๐ โ†’ ๐“๐ž๐ฑ๐ญ ๐Ž๐ฎ๐ญ๐ฉ๐ฎ๐ญ โ†’ ๐€๐ˆ That creates several problems: โ€ข AI must interpret inconsistent command output. โ€ข Operational context lives outside the shell. โ€ข Policies and approvals aren't inherent to execution. โ€ข Platforms expose different commands and output formats. โ€ข The runtime has little understanding of ๐˜ธ๐˜ฉ๐˜ข๐˜ต is actually being operated on.

I think we're asking AI to solve the wrong problem. Instead of teaching AI every shell command, perhaps we should give it a better operational interface. Imagine infrastructure represented as structured resources instead of arbitrary commands.

Instead of: ๐˜ด๐˜บ๐˜ด๐˜ต๐˜ฆ๐˜ฎ๐˜ค๐˜ต๐˜ญ ๐˜ณ๐˜ฆ๐˜ด๐˜ต๐˜ข๐˜ณ๐˜ต ๐˜ฏ๐˜จ๐˜ช๐˜ฏ๐˜น

an AI could request something conceptually like: ๐˜ด๐˜ท๐˜ค://๐˜ฏ๐˜จ๐˜ช๐˜ฏ๐˜น ๐˜ณ๐˜ฆ๐˜ด๐˜ต๐˜ข๐˜ณ๐˜ต

Now the runtimeโ€”not the language modelโ€”can determine: โ€ข Is the resource valid? โ€ข Is the operation supported? โ€ข What depends on it? โ€ข What's the risk? โ€ข Does policy allow it? โ€ข Is approval required? โ€ข Can it be simulated first? โ€ข How should it be audited?

That changes the question from "๐‚๐š๐ง ๐ญ๐ก๐ž ๐€๐ˆ ๐ ๐ž๐ง๐ž๐ซ๐š๐ญ๐ž ๐ญ๐ก๐ž ๐ซ๐ข๐ ๐ก๐ญ ๐œ๐จ๐ฆ๐ฆ๐š๐ง๐?" to "๐‚๐š๐ง ๐ญ๐ก๐ž ๐ซ๐ฎ๐ง๐ญ๐ข๐ฆ๐ž ๐ฌ๐š๐Ÿ๐ž๐ฅ๐ฒ ๐ž๐ฑ๐ž๐œ๐ฎ๐ญ๐ž ๐ญ๐ก๐ž ๐ซ๐ž๐ช๐ฎ๐ž๐ฌ๐ญ?" To me, that's a much stronger foundation for enterprise AI.

It's one of the ideas behind an open-source project I've been building called ๐‘๐ž๐ฌ๐จ๐ฎ๐ซ๐œ๐ž ๐’๐ก๐ž๐ฅ๐ฅ (๐ซ๐ž๐ฌ๐ก). It explores a resource-oriented operational model designed for AI-assisted infrastructure rather than adapting command-line interfaces built decades ago.

As AI becomes more involved in production operations, should we continue giving agents direct access to shell commands, or is it time to rethink the operational interface?

All blog posts

Have a problem like this in your own systems?

Tell us what you're building or what needs fixing. We'll help you work out what should be built, and the smallest useful first step.