AID-H-025: Unsafe Code Execution Prevention
Prevent unexpected code execution (RCE) through unsafe evaluation paths by banning dangerous constructs, enforcing safe interpreters, and requiring a pre-execution static scan gate for agent-generated code. This is a cheap, fail-fast preventive layer that complements sandbox containment and dynamic behavioral analysis.
Scope boundary
Groups preventive controls that reject dangerous executable content before use or constrain it to an approved restricted interpreter. It does not provide the operating-system, container, or WASM containment boundary for arbitrary execution.
AID-I-001: AID-H-025 prevents or narrows unsafe evaluation paths before execution; AID-I-001 contains code that is permitted to execute. Static or interpreter-level restrictions cannot replace an independently enforced sandbox.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0050 Command and Scripting Interpreter
- AML.T0072 Cyber Communication Channel
- AML.T0102 Generate Malicious Commands
- AML.T0105 Escape to Host
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.001 AI Agent Tool Poisoning: Implementation
- AML.T0115 Publish Poisoned AI Artifacts
- AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
MAESTRO
- Agent Tool Misuse (L7)
OWASP LLM Top 10 2026
- LLM03:2026 Excessive Agency
- LLM10:2026 Improper Output Handling
OWASP ML Top 10 2023
- ML09:2023 Output Integrity Attack
OWASP Top 10 for Agentic Applications 2026
- ASI02:2026 Tool Misuse and Exploitation
- ASI05:2026 Unexpected Code Execution (RCE)
NIST Adversarial Machine Learning 2025
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-9.1 Model or Agentic System Manipulation
- AITech-12.1 Tool Exploitation
- AITech-12.2 Insecure Output Handling
- AISubtech-9.1.1 Code Execution
- AISubtech-9.1.2 Unauthorized or Unsolicited System Access
- AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
- AISubtech-12.1.3 Unsafe System / Browser / File Execution
- AISubtech-12.2.1 Code Detection / Malicious Code Output
Google Secure AI Framework 2.0 - Risks
- IMO: Insecure Model Output
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model Serving - Inference requests 9.3: Model breakout
- Platform 12.5: Poor security in the software development lifecycle
- Agents - Core 13.11: Unexpected RCE and Code Attacks
- Agents - Tools MCP Client 13.32: Client-Side Code Execution