Many AI agents are not just text generators — they can write code in Python, JavaScript, SQL, shell script, or other languages, and then run that code against real systems: databases, file systems, APIs, cloud infrastructure, operating system processes.

This is what makes agents so capable. A coding assistant can fix your bug and run the tests. A data agent can write a query and execute it. An infrastructure agent can generate a Terraform plan and apply it. The code is real, and the effects are real.

"Unexpected" is the key word. The code the agent generates and runs may be unexpected in several ways:

Unexpected by the operator: The code does something the person who built the agent never anticipated it doing — because the instruction was ambiguous, because the agent inferred a broader scope than intended, or because a malicious input drove the agent to generate harmful code.

Unexpected by the user: The agent does more than the user asked — or something entirely different — because the agent interpreted the goal more aggressively than the user meant.

Unexpected in its side effects: The code's primary effect was intended, but it had unintended consequences — deleting more than planned, touching systems that weren't meant to be involved, consuming more resources than anticipated.

Code execution is immediate, often irreversible, and operates at computer speed. An agent that misunderstands a natural-language instruction can delete a database, open a network socket, spawn subprocesses, or exfiltrate data in the time it takes a human to read a status update. The speed and irreversibility of code execution is what elevates this from a minor error to a security risk.