Used in: Definition slides (03–04), vulnerability framework (09–13), mitigation framework (18–25). The primary authoritative source for the ASI05 definition, root causes (malicious inputs and insufficient sandboxing), and the distinction between intended and unintended code execution scope.

Used in: Slide 11 (Type 1 real example). Researchers documented that ChatGPT's code execution environment exposed environment variables, accessible filesystem portions, and subprocess execution capabilities that were assumed to be restricted. Demonstrates that assumption of sandbox isolation is not the same as verified sandbox isolation.

Used in: Slide 14 (Scenario 1). Documented attack pattern in which instructions hidden in documents (white text on white background, zero-font characters, or metadata fields) cause LLM agents to execute attacker-defined actions including data exfiltration through generated code. Multiple real-world demonstrations against document-processing agents.

Used in: Slide 14 (Scenario 2). Multiple reported incidents in which coding agents asked to "clean up build artifacts" or similar ambiguous instructions interpreted the scope broadly and deleted source directories, git history, or project configuration. No attacker involved — pure scope ambiguity in autonomous execution without confirmation gates.

Used in: Slides 13, 15 (Type 4 / Scenario 3). Documented attack pattern: crafted inputs cause an agent to generate code that calls the cloud metadata service (169.254.169.254) and exfiltrates the resulting IAM credentials. The attack exploits the fact that the metadata service returns credentials to any process that can reach it — including agent-generated code running in the cloud execution environment.

Used in: Slides 13, 15 (Type 5 / Scenario 4). Research demonstrating that LLM coding agents can be induced via crafted task specifications or prompt injection to insert backdoor code (such as authentication bypasses and diagnostic endpoints that exfiltrate headers) disguised as legitimate functionality. The "health check bypass" pattern is a documented category of AI-generated backdoor insertion.

Used in: Slide 19 (MIT01 implementation options). gVisor provides kernel-level isolation for containers by intercepting syscalls via a user-space kernel, making it one of the strongest available sandbox implementations for agent code execution environments.

Used in: Slide 19 (MIT01 implementation options). Firecracker provides hardware-virtualization-based isolation for workloads, used by AWS Lambda and AWS Fargate for production code execution isolation. Cited as a production-grade sandbox implementation option for agent code execution.

Used in: Mitigation framework (slides 18–25). ASVS requirements for code isolation, secret management, and logging inform the nine-mitigation framework. Particularly relevant: V1 (Architecture), V8 (Data Protection), and V10 (Malicious Code) requirements as applied to agent-generated code execution.

Used in: MIT04 (least-privilege execution) and MIT07 (secrets isolation) design principles. Least-privilege container execution, non-root process identity, and secrets management via external stores are established microservices security practices applied here to agent sandbox environments.

Used in: Slide 24 (MIT09 — generated code scanning). Referenced as examples of secret scanning tools that can detect hardcoded credentials in generated code before it reaches a repository. Part of the generated code scanning layer for the deployment pipeline.

Used in: Slides 22, 24 (MIT05 and MIT09). Referenced as SAST tools that can detect dangerous function calls, backdoor patterns, and injection vulnerabilities in generated code using the same rulesets applied to human-written code. Core tooling for the automated pre-execution and pre-deployment code review layers.