Every scenario in this module has the same anatomy:

Step 1 — Instruction or input arrives. It may come from a trusted user (Scenarios 2, 6), a crafted malicious source (Scenarios 1, 3, 4), or a research demonstration (Scenario 5). The agent receives it as valid input.

Step 2 — The agent generates code. The code is the agent's best interpretation of what the instruction requires. In attack scenarios, the attacker has shaped the interpretation. In ambiguity scenarios, the interpretation is plausible but wrong.

Step 3 — The code executes immediately. There is no review step, no confirmation, no scope check between the code being generated and it running against real systems.

Step 4 — The effects are real and immediate. Files are deleted, data is exfiltrated, credentials are harvested, resources are exhausted. The execution happened at machine speed before anyone could intervene.

The gap to defend is Step 3: the space between generation and execution. Every effective mitigation for AG05 either:
(a) limits what code can do even after it executes — sandboxing, resource limits, network isolation;
(b) inserts a human or automated review between generation and execution — confirmation steps, code scanning, policy checks;
or (c) reduces the scope of what can be affected — least-privilege environments, read-only filesystem mounts, immutable infrastructure.