T11 (Unexpected RCE) in Sequential

How the attack unfolds

1. 1. The setup

   The target is a Sequential Agent Architecture. A straightforward linear workflow where a single agent processes tasks through a linear workflow. This design typically uses a single KC1.1 (Large Language Model) as its cognitive core, guided by a KC2.1 (Sequential workflow) and KC3.3 (Chain of Thought) reasoning.

2. 2. The attack

   If the agent is granted KC6.2 (Code Execution) capabilities, even in a limited form, it creates a direct risk of remote code execution if an attacker can successfully inject malicious code for the agent to run.

   Threat T11 · Component KC6 · High

3. 3. Technique: Script Upload & Execution

   Uploading and executing malicious scripts. The threat catalog rates this T11 vector high.

   Threat T11 · Component KC5 · High

4. 4. Threat: T11 Unexpected RCE

   T11 Unexpected RCE and Code Attacks: Tools or environments enabling unexpected code execution, presenting direct risks to code execution environments.

   Threat T11 · Component KC6 · High

5. 5. In the wild: Multi-Tool Chain Exploitation

   ASI05 Unexpected Code Execution (RCE) in the OWASP Top 10 for Agentic Applications describes the same pattern: An attacker crafts a prompt that causes the agent to invoke a series of tools in sequence (file upload -> path traversal -> dynamic code loading), achieving code execution.

   Threat T11 · Component KC5 · High

Threats involved

• T11 Unexpected RCE and Code Attacks: Tools or environments enabling unexpected code execution, presenting direct risks to code execution environments.

Controls that stop it

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M2 Tool Sandboxing & Isolation

  Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

• M7 Zero Trust & Least Privilege Access

  Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.

• M14 Runtime Security Controls & Sandboxing

  Implement comprehensive runtime security controls including advanced sandboxing, execution monitoring, and dynamic security policy enforcement to prevent unexpected code execution and contain security breaches in real-time.

• M17 Supply Chain Security & Provenance

  Implement comprehensive supply chain security including model provenance verification, dependency management, secure development environments, and third-party component validation to prevent supply chain attacks and ensure component integrity.

• M18 Incident Response & Recovery Framework

  Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.