Unexpected Code Execution — Generated or tool-invoked code runs with more reach than anyone intended.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
Frequently self-inflicted. A test runner that auto-executes files, a sandbox with a writable mount into the host, an eval that was convenient during development. The agent did not break out; the boundary was never there.
Controls that address it
- Rootless containers, read-only mounts, deny-by-default networking.
- Refuse writes to any path the test harness auto-executes — pytest plus write access is remote code execution.
- Isolate per agent and per run; never share a mutable workspace between agents.
- Egress allowlists so exfiltration has nowhere to go.
- Treat any generated code as untrusted input regardless of which model produced it.
The evidence that proves the control fired
An execution_receipt naming the sandbox profile and the effect owner, so 'where did this run' is a lookup rather than an investigation.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
Isolation is only as good as its weakest mount. Audit the mounts, not the policy document describing them.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
← ASI04 Agentic Supply Chain Vulnerabilities ASI06 Memory and Context Poisoning →
Common questions
What is ASI05 unexpected code execution?
ASI05 unexpected code execution — Generated content reaches an interpreter and runs.
How do you defend against it?
Never pass model output to an execution surface without a gate. Where code execution is the point, sandbox it with no network and no credentials.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.