Run a suggested command from a Live Session answer, November 11, 2026

On November 11, 2026, ET Ducky added Run buttons under the commands in an AI answer. When a Live Session answer suggests a command, you can run it on that device from the answer and read the output under it, without copying it into the Shell tab. This entry has no screenshots yet. The buttons appear only under a new answer in an active session.

Which blocks get a Run button

A code block gets "Run" when it names a shell for the agent's platform. That is PowerShell or CMD on Windows agents, and Bash or Sh on Linux agents. A one-line block also gets "Edit in Shell", which opens the Shell tab with the command in the command line so you can change it first.

Some blocks get no buttons. These are a block for the other platform, a block that names no shell, a block with a prompt in front of the command, a CMD block of more than one line, and a block with hidden or direction-changing characters. A command with a value in angle brackets, such as <service name>, gets only "Edit in Shell".

When a command asks first

The server decides whether a command runs on the first click. A command that passes the read-only check the AI's own investigation commands use, such as Get-Service, ipconfig /all, systemctl status, or df -h, runs when you click "Run". Any other command first shows the command, the device and the account it runs as. It runs only when you click "Run" again.

The server runs only a command that is a whole code block of that answer, in the session that showed it. After the session ends, the buttons run nothing.

The account a command runs as

"Run" uses the same path as the Shell tab. The command runs as the agent service account, which is Local System on managed Windows agents and the etducky account on Linux agents. The 5-minute timeout, the technician role requirement, the hourly command limit, and the command checks are the same as for a command you type.

On Windows, "Run as logged-in user" runs the command as the user signed in at the console. On Linux, a one-line sudo <command> block also gets "Run as root", with the same requirements as the Shell tab's "Run as root" box. Both always ask first.

Output and follow-up questions

The output appears under the block and in the Shell tab. "Ask about this output" sends the command and the first 4,000 characters of its output to the AI as your next question, marked as data from the device. It uses queries from your organization pool like any other question.

Request approval

When the command checks block a command that an approval can allow, the block shows "Request approval". It opens a Command Approval ticket in your organization for that exact command, device and answer. A workspace owner or organization administrator approves or rejects it on the Tickets page. The person who requested it cannot approve it, except in a one-person organization or through a workspace owner's recorded override.

Where the buttons appear

The buttons appear in Live Session answers, in Multi-Agent Session answers, and in the Ask Ducky tab of the remote control side panel. In a Multi-Agent Session each answer runs only on the agent that sent it. The audit log records that the command was run from an answer and the account it ran as.