Agentic Security Hub

Threat T11

Unexpected RCE and Code Attacks

Tools or environments enabling unexpected code execution, presenting direct risks to code execution environments.

  • 9/10 risk (Critical)
  • 6 attack vectors
  • 7 mitigating controls
  • 9 framework refs

Open in Threat ModelerAll threats

Overview

  • Impact level: High
  • Risk score: 9/10 (Critical)
  • CIA impact: Confidentiality, Integrity, Availability
  • Affected components: Tool Integration Layer (KC5.1-KC5.4); External Environment Interface (KC6.1-KC6.3)
  • Tags: code-execution, rce, sandbox, injection, interpreter
  • Source: OWASP Agentic AI T&M v1.1 (2025-12)

Attack vectors

How attackers carry out unexpected rce and code attacks against an agentic system.

Attack vectorSeverityExample
Code Injection via ToolsHighInjecting malicious code through tool parameters
Interpreter ExploitationHighExploiting code interpreter environments
Command InjectionHighExecuting system commands through tool interfaces
Script Upload & ExecutionHighUploading and executing malicious scripts
Environment EscapeMediumBreaking out of sandboxed execution environments
Deserialization AttacksMediumExploiting unsafe deserialization in tool data

Affected components

KC5 Tool Integration Frameworks

KC6 Operational Environment (Agencies)

Mitigating controls

Controls from the catalog that reduce the likelihood or impact of T11.

  • M2 Tool Sandboxing & Isolation

    Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

  • M7 Zero Trust & Least Privilege Access

    Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.

  • M13 Secure Development Lifecycle Integration

    Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

  • M14 Runtime Security Controls & Sandboxing

    Implement comprehensive runtime security controls including advanced sandboxing, execution monitoring, and dynamic security policy enforcement to prevent unexpected code execution and contain security breaches in real-time.

  • M17 Supply Chain Security & Provenance

    Implement comprehensive supply chain security including model provenance verification, dependency management, secure development environments, and third-party component validation to prevent supply chain attacks and ensure component integrity.

  • M18 Incident Response & Recovery Framework

    Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.

  • M20 Agent Supply-Chain Integrity

    Extend software supply-chain controls to everything an agent loads at build or run time: models and adapters, prompt templates, agent cards, tool and MCP server definitions, plugins and framework updates.

Framework mappings

OWASP Top 10 for Agentic Applications

Cisco AI Security Taxonomy

OWASP AIVSS core risks

OWASP AISVS

Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C8 Memory, Embeddings & Vector Database Security, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C12 Monitoring, Logging & Anomaly Detection.

Requirements: C9.1.1, C9.3.1, C9.3.3, C9.3.4, C9.3.5, C9.3.6, C9.3.9, C4.1.1, C10.1.3, C5.1.1, C5.1.2, C5.2.1, C5.2.2, C5.2.5, C5.2.6, C9.5.1, C9.5.2, C9.5.3, C9.5.6, C9.5.7, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C6.1.4, C4.1.2, C4.1.3, C4.3.3, C9.3.8, C9.6.1, C6.1.1, C6.1.2, C6.1.3, C6.2.1, C6.2.2, C6.2.3, C3.1.2, C3.1.3, C1.1.2, C9.6.3, C9.1.3, C12.4.3, C12.5.3, C3.3.2, C8.3.2, C9.2.5, C9.3.7, C10.1.1, C10.4.8.

MITRE ATLAS

Attack walkthroughs

  • MCP Tool Descriptor Poisoning: A prompt injection in GitHub's MCP where a malicious public tool hides commands in its metadata; the assistant exfiltrates private repo data.
  • Replit 'Vibe Coding' Runaway Execution: During automated self-repair tasks, an agent generates and executes unreviewed install or shell commands, deleting or overwriting production data.
  • Direct Shell Injection: An attacker submits a prompt containing embedded shell commands disguised as legitimate instructions, resulting in unauthorized system access.
  • Memory System RCE: An attacker exploits an unsafe eval() function in the agent's memory system by embedding executable code within prompts.
  • Multi-Tool Chain Exploitation: An attacker crafts a prompt that causes the agent to invoke a series of tools in sequence (file upload -> path traversal -> dynamic code loading), achieving code execution.
  • T11 (Unexpected RCE) in Sequential: If the agent is granted KC6.2 (Code Execution) capabilities, even in a limited form, it creates a direct risk of remote code execution if an attacker can successfully inject malicious code for the agent to run.
  • T2 (Tool Misuse) & T11 (Unexpected RCE) in Reactive: The rapid action-taking nature of reactive agents creates risks when tools are invoked quickly without thorough validation.

References

Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11