Unexpected Code Execution: When Your Agent Becomes a Shell (ASI05)

Short summary

ASI05 from the OWASP Agentic AI Top 10 covers unexpected code execution in AI agents, where prompt injection turns an agent's code-generation capability into a remote code execution vector. Real incidents include Microsoft AutoGen Studio's AutoJack exploit, two CVSS 9.9 CVEs in Semantic Kernel, and AWS AgentCore sandbox bypasses. The article argues that sandboxes are necessary but insufficient — agents need layered defenses including human-in-the-loop review and runtime monitoring.

• •Agent-based RCE differs from traditional RCE: code execution is the feature, not the bug — the wrong code runs without human review
• •Real-world incidents include Microsoft AutoJack, Semantic Kernel CVEs (9.9), VS Code agentic AI flaws, and AWS AgentCore sandbox bypasses
• •Sandboxes alone are insufficient; layered defenses including human review, runtime monitoring, and tool scoping are required

Generated with AI, which can make mistakes.