A vulnerability in the agent's own source code — a buffer overflow, a SQL injection in the agent's backend, a dependency with a known CVE — is a traditional software security issue. AG05 is about code the agent generates and executes dynamically against external systems, not vulnerabilities in how the agent itself was built.
If someone exploited a flaw in the agent's web server to gain access — that's a traditional web app vulnerability. If the agent wrote and ran a script that opened that access — that's AG05.
If an agent calls an approved API tool — a send-email tool, a database query tool, a file-read tool — and uses that tool in an unintended way, that's a different category of risk about authorization and tool misuse. AG05 is specifically about the agent writing new code and executing it in an interpreter or shell, not about using pre-defined tools.
The distinction: "agent calls a DELETE tool it was given" is tool misuse. "Agent writes a DELETE script and runs it in a Python interpreter" is AG05.
AG05 includes fully unintentional incidents with no adversary — where an agent interpreted an instruction too broadly and ran code that caused unintended damage. The risk exists any time an agent has code execution capability, even in fully trusted, internal use. Restricting the definition to "attacker-caused" misses the majority of real-world AG05 incidents.
AG05 is: the agent wrote code at runtime and ran it against real systems, and the code did something outside the intended scope — whether due to ambiguous instructions, attacker-shaped input, a flawed sandbox, or missing confirmation controls. The attack surface is the gap between "generate" and "execute."