Dynamic Code Execution

Agents evaluate model-generated code or shell snippets in-process without a sandbox boundary.

Impact

Arbitrary code execution yields host compromise, credential theft, and lateral movement.

Why this severity

Impact High × Likelihood Medium = High

Impact high: host compromise. Likelihood medium: researchers found 20 RCEs in deployed LLM apps and demonstrated execution through MathGPT and computer-use agents, all as demonstrations.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Demonstration: LLMSmith: RCE Vulnerabilities in LLM-Integrated Applications (MITRE ATLAS case study AML.CS0052, 2025)
Demonstration: Achieving Code Execution in MathGPT via Prompt Injection (MITRE ATLAS case study AML.CS0016, 2023)
Demonstration: Data Destruction via Indirect Prompt Injection Targeting Claude Computer-Use (MITRE ATLAS case study AML.CS0046, 2024)

Exploited by

Goal Alignment Drift Threat · High severity
Prompt-to-Code Execution in Agents Threat · High severity
Unbounded MCP Tool Calls Threat · Medium severity

Mitigated by

Hardened Execution Sandbox Guardrail · Fixes high risks

Remediation

Run generated code only inside ephemeral containers with no secrets mounted.
Disable network egress unless explicitly gated.
Prefer declarative tool APIs over eval/exec pathways.

How to verify

Attempt breakout payloads (env dump, socket open) inside the sandbox.
Confirm host PID namespace and secrets are unreachable.

Pattern

await sandbox.run(code, { network: false, mounts: [], timeoutMs: 5000 });

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM05:2025 Improper Output Handling
LLM06:2025 Excessive Agency

OWASP Top 10 for Agentic Applications 2026

ASI05:2026 Unexpected Code Execution

MITRE ATLAS

AML.T0105 Escape to Host
AML.T0053 AI Agent Tool Invocation

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented