Unexpected RCE and Code Attacks
- Tools & External Data
- Output / Actuation
Attackers exploit an agent's code-generation or code-execution capability to run unsafe or malicious code, escalate privilege, or compromise the host system directly.
What it is
Unexpected RCE and code attacks occur when an agent's code-generation or code-execution capability is turned into a genuine execution primitive: attackers manipulate the agent's tool-integrated code path to generate unsafe code, trigger unintended system behavior, or run unauthorized scripts. The threat differs from Prompt Injection and Improper Output Handling in kind, not degree — those describe a misleading text response a person or downstream parser has to act on, while an agent with function-calling and tool integration can be driven to directly execute the resulting code, turning a manipulated response into a system compromise rather than a display problem. Because the agent, not a human reviewer, is what runs the generated code, the review step a developer would normally apply to unfamiliar code never fires — the malicious payload rides inside code that otherwise does what was asked, as a small, plausible addition like a disabled log line or an extra network call rather than an obviously foreign block. This makes the threat a critical vector specifically in AI-driven automation and service integration, where 'the agent wrote code and immediately ran it' is the normal operating mode, not an edge case.
Kinds
- Malicious code generation
- An attacker manipulates the agent into generating code — an infrastructure script, a workflow automation step — that embeds a hidden, damaging command alongside its legitimate output, so the payload ships inside code that otherwise does what was asked.
- Command execution via linguistic ambiguity
- An attacker exploits ambiguity in a natural-language instruction to an agent with execution privileges, crafting a request that reads as benign but resolves, once parsed, to an unauthorized or destructive command.
Attack scenarios
A DevOps agent is manipulated into generating an infrastructure script that embeds a hidden command disabling logging before it provisions the requested resource.
DevOps agent compromise
An attacker manipulates an AI-powered DevOps agent into generating a Terraform script containing hidden commands that extract secrets and disable logging before the agent applies it.
Workflow engine exploitation
An AI-driven workflow automation system executes malicious AI-generated scripts with embedded backdoors, bypassing security validation and giving the attacker unauthorized control.
Linguistic ambiguity exploitation
An attacker leverages language-based ambiguity in a natural-language email agent to craft a command that reads as routine but resolves to exfiltrating sensitive emails via POP3.
Mitigations
- Sandbox every execution
- Sandbox Execution runs AI-invoked code in an isolated, containerized environment with no access to sensitive system resources or the broader network, applies resource and system-call limits, and destroys the sandbox after each run to block persistence.
- Restrict what the agent can generate and run
- Restrict AI code-generation permissions to the minimum a task needs, per Least Privilege Agent, and require function-level authentication before an agent can invoke a tool at all.
- Flag privileged code for human review
- Execution-control policies flag AI-generated code carrying elevated privileges for manual review before it runs, rather than letting generation and execution happen in the same uninterrupted step.
- Log and monitor generated code
- Log every AI-generated script and tool interaction with forensic traceability via the Audit Trail, and detect command chaining or abnormal execution frequency that circumvents intended policy.