Every other risk in this course ultimately produces some form of output — text, a decision, a recommendation, a credential. AG05 produces execution. And execution against real systems has properties that text does not:
Immediacy: The code runs the moment the agent invokes the interpreter. There is no buffer between generation and effect.
Irreversibility: A deleted row, a wiped file, a modified firewall rule, a committed backdoor — these don't un-execute when you realize the mistake.
Scale: A script running against a database doesn't delete one row — it deletes every row matching the condition. Code operates at machine scale, not human scale.
Composability: Code can call other code, spawn processes, open network connections, and chain effects in ways that are impossible to predict from the original instruction.
When a human writes a destructive script, there are multiple natural confirmation points: writing the code, reviewing it, deciding to run it, seeing the output. An agent collapses all of these into a single autonomous step. The confirmation gap is the space where human judgment used to live — and where AG05 incidents happen.
The six vulnerability types in Part 2 describe the specific mechanisms by which code execution escapes its intended scope — through sandbox failures, filesystem overreach, network access, privilege escalation, backdoor insertion, and resource exhaustion. Each is a different shape of the same underlying problem: code that ran when it shouldn't have, or did more than it should have.