AG05:2026 — Unexpected Code Execution

Slide 4 · The Definition Part 2

The execution gap — why code agents operate in a space that traditional software never occupied

Traditional code runs exactly what was written and reviewed. Agent-generated code runs what the agent decided to write, right now, against your live systems.

Traditional software execution

Code written by a human developer. The author knows what it does and intended it.

Code reviewed before shipping. At least one other person read it before it ran in production.

Code tested before deployment. Test suites, staging environments, QA processes verify behavior.

Code changes are deliberate. A deployment is a conscious act with documented intent.

Rollback is planned. Reversibility is a design consideration.

Agent-generated code execution

Code written by the model at runtime. The author is a probability distribution over tokens. Intent is inferred, not declared.

Code executed immediately. No review step between generation and execution unless explicitly built in.

Code untested. There is no staging run, no test suite for dynamically-generated code.

Code executes as part of a larger goal. The agent may generate multiple code steps; each builds on the last with no human checkpoint.

Effects are immediate and may be irreversible. DELETE, DROP, rm -rf — these don't ask for confirmation.

The central tension

The power of code-executing agents is that they remove friction. A human developer would write the script, review it, test it, then run it. An agent does all of this in one step — which is why it's valuable, and why it's dangerous. The friction that was removed was also serving as a safety check.

The one-sentence version

AG05 is the risk that code the agent wrote and ran against real systems did something nobody intended — because the instructions were ambiguous, because an attacker shaped the input, or because no one built a guard between "generate" and "execute."

← Back What can unexpected code execution actually do? →