AI Security Atlas › All entries › Autonomous Agent & MCP Security
Prompt-to-Code Execution in Agents
Injected instructions make an agent write and run code, shell commands, or package installs on infrastructure it can reach.
Open in the interactive atlas →Impact
Remote code execution through natural language, often with the agent's credentials and network access.
Why this severity
Impact High × Likelihood Medium = High
Impact high: host and credential compromise. Likelihood medium: shown against Cursor, Claude computer use, and OpenClaw, but catalogued only as demonstrations.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Demonstration: Data Exfiltration via an MCP Server used by Cursor (MITRE ATLAS case study AML.CS0045, 2025)
- Demonstration: Data Destruction via Indirect Prompt Injection Targeting Claude Computer-Use (MITRE ATLAS case study AML.CS0046, 2024)
- Demonstration: OpenClaw Command & Control via Prompt Injection (MITRE ATLAS case study AML.CS0051, 2026)
- Demonstration: AI ClickFix: Hijacking Computer-Use Agents Using ClickFix (MITRE ATLAS case study AML.CS0055, 2025)
Related
Exploits
- Dynamic Code Execution Vulnerability · High severity
- Unvalidated Function Arguments Vulnerability · High severity
Follows from
- Agent Tool Hijacking Threat · High severity
Mitigated by
- Hardened Execution Sandbox Guardrail · Fixes high risks
Remediation
- Run generated code only in an isolated, ephemeral sandbox.
- Ban eval/exec on model output in the agent's own process.
- Require approval for package installs and elevated runs.
How to verify
- Red-team with injection payloads that request shell access or package installs.
- Confirm sandbox escapes are blocked and logged.
Framework mapping
OWASP Top 10 for Agentic Applications 2026
- ASI05:2026 Unexpected Code Execution
OWASP Top 10 for LLM Applications 2025
- LLM01:2025 Prompt Injection
- LLM05:2025 Improper Output Handling
MITRE ATLAS
- AML.T0050 Command and Scripting Interpreter
- AML.T0053 AI Agent Tool Invocation
- AML.T0105 Escape to Host
NIST AI RMF 1.0
- MEASURE 2.7 AI system security and resilience are evaluated and documented