AG05:2026 — Unexpected Code Execution

Slide 3 · The Definition Part 1

The official definition — what OWASP means by unexpected code execution in agentic systems

Three conditions make this a distinct security risk: the agent generates the code, it executes it without pre-approval, and the effects reach real systems.

📄 OWASP Top 10 for Agentic Applications 2026 · ASI05

"Unexpected Code Execution arises when an agent generates and executes code — in a code interpreter, shell, or other runtime environment — that performs actions beyond the intended scope, including remote code execution on host systems, exfiltration of sensitive data, or modification of critical resources, often triggered by malicious inputs or insufficient sandboxing."

Three parts of the definition

1. The agent generates and executes code. This is not about code in the agent's own codebase. It's about code the agent writes at runtime — in response to instructions, queries, or goals — and then runs in an interpreter, shell, REPL, or similar environment.

2. The code performs actions beyond intended scope. "Scope" here means the boundaries the operator and user intended: which systems, which data, which operations, which scale. Unexpected execution crosses those boundaries — sometimes through attacker manipulation, sometimes through ambiguous instructions, sometimes through the agent inferring too aggressively.

3. The effects reach real systems. The code runs against live infrastructure — production databases, file systems, cloud APIs, operating system processes, network endpoints. The consequences are real, immediate, and often irreversible.

Two root causes OWASP identifies

Malicious inputs: an attacker crafts input that drives the agent to generate and run harmful code — a form of code injection through natural language.

Insufficient sandboxing: the agent's code execution environment has access to more than it should — no resource limits, no network isolation, no filesystem restrictions — so when code runs unexpectedly, the blast radius is large.

← Back Why agentic code execution is fundamentally different →