Commands with ambiguous syntax containing command separators (;, &&, ||) combined with unbalanced brackets, parentheses, or quotes now trigger permission prompts to prevent potential injection attacks.
Evidence
_j5() at line 366196 (security checker, contains "MALFORMED_TOKEN_INJECTION")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.