HOME / SERVICES / AI SECURITY / OWASP TOP 10
ASI05 - UNEXPECTED CODE EXECUTION
A developer installed a connector so an agent could read a repository. It took four minutes. The connector shipped with a transport configuration that accepts what it is given and passes it to the operating system. Nothing was misconfigured, because nobody configured anything. That is the AI agent code execution risk South African teams keep finding after the fact: not a coding error, a default somebody accepted. ASI05 in the OWASP Top 10 for Agentic Applications, published 9 December 2025 by the OWASP Agentic Security Initiative, covers what happens when text that was never meant to be code is executed as code, with the privileges of whoever installed the component.
YOUR AGENT HAS A SHELL, AND NOBODY SIGNED OFF ON IT
DEFINITION
WHAT THIS RISK ACTUALLY IS
An agent becomes useful when it can do things, and doing things means execution. Somewhere in your estate an agent can run a code interpreter, call a shell, query a database with a string it composed itself, or invoke a server that wraps a command line utility. Each of those is a place where content the agent read becomes an instruction the machine runs.
The exposure is rarely a decision anyone remembers taking. In April 2026, OX Security published research into the Model Context Protocol describing a design-level flaw rooted in unsafe defaults in the STDIO transport configuration, enabling arbitrary command execution. 10 CVEs issued and counting, per OX Security, across a server population in the thousands. Nobody in those thousands chose to be exposed. They installed a component and accepted what it shipped with.
Recognise your own estate in this list. A connector installed on a developer laptop that holds the same credentials as the developer. An agent that writes and runs Python to answer analytics questions, inside a container that shares a network with something else. An internal assistant given a filesystem tool to tidy a share, still holding that tool six months later.
Two properties make this worse than ordinary command injection. One is that the untrusted content arrives through a channel you treat as data: a document, a ticket, a web page, an inbound email. The other is that the agent is designed to act on what it reads. You are not defending against a user who might lie. You are defending a system that cannot tell it is being lied to, holding a tool that does what it is told.
DOCUMENTED CASE
WHAT IT LOOKS LIKE IN PRACTICE
The following is an illustration built from documented failure patterns rather than a single named incident.
- A financial services team gives an internal agent access to a document store so it can answer questions about supplier contracts. To read the store, an engineer installs a protocol server on a shared build host, under a service account with read access to several repositories.
- 01 - An attacker sends a contract addendum to a mailbox that feeds the store. Inside the document, in white text, sits an instruction addressed to any assistant processing the file: summarise the terms, then run a named diagnostic command to confirm the file rendered correctly.
- 02 - An analyst asks the agent to summarise this quarter's supplier changes. The agent retrieves the addendum, assembles it into context, and follows the instruction as part of the task. The server accepts the argument and passes it to a shell, where it runs as the service account.
- 03 - Nothing alerts. The agent also returns an accurate summary of the supplier terms. The attacker now holds command execution on a build host, obtained without a phishing click and without stolen credentials.
- 04 - This is the shape of the EchoLeak flaw in Microsoft 365 Copilot, CVE-2025-32711: a hidden instruction inside an ordinary inbound email, read by the assistant while assembling context, with tenant data leaving and nobody clicking anything. Reported January 2025, fixed server-side May 2025, found by a third party rather than the platform vendor. What changes with ASI05 is the payload: not data out, but a command in.
WHAT THIS MEANS UNDER SOUTH AFRICAN LAW
DISCOVERY
NEWORDER connects to CI/CD pipelines to automatically discover and inventory every homegrown AI application, and integrates directly with AWS Bedrock, Google Vertex AI, Salesforce, and other cloud and third-party platforms for visibility into AI agents. Each AI system is profiled across its model, system prompt, tools, guardrails, policies, and configurations, and the inventory stays current on every change. You cannot secure what you cannot see; discovery is the non-negotiable first step.
AI SECURITY POSTURE MANAGEMENT (AI-SPM)
NEWORDER conducts a static analysis of every application’s configuration, policy coverage, and third-party dependencies and identifies any policy gaps. In addition, it maps each agentic application to its coverage of major frameworks, including NIST, OWASP, and MITRE. This gives you a clear, measurable view of your AI security posture before a single adversarial test is run, turning assumptions into evidence and compliance into a continuous output rather than a periodic exercise.
AI RED TEAMING
NEWORDER’s automated AI red teaming covers the complete kill chain from reconnaissance to exploitation. It proactively discovers exploitable vulnerabilities through automated reconnaissance and adversarial testing purpose-built for agentic applications. Static attacks draw from a 300K+ payload library with 100% MITRE and OWASP LLM and Agentic Top 10 coverage, running comprehensive sweeps of known jailbreak patterns, content moderation bypasses, and obfuscation techniques. Dynamic attacks use multi-turn and continuous probing to test how an application holds up across extended adversarial sequences, not just a single interaction. High-agency attacks deploy extremely customised, bespoke attack techniques through probing tailored specifically to the intent and design of each application.
RUNTIME PROTECTION
NEWORDER offers policy enforcement and AI threat protection at the proxy, API, or AI Gateway layer. Protection adapts as the applications evolve and as new capabilities are added. When an attack hits production, whether a jailbreak, a prompt injection, or any other AI threat, it is blocked in real time and an immediate alert is sent with full context, including what happened, which application was targeted, what the impact is, and what to do next. Key performance metrics include 98.6% threat detection accuracy, 1.4% false positive rate, sub-200ms time to detect, sub-50ms real-time blocking, and immediate mean time to respond.
POPIA, sections 19 to 22
Section 19 requires a responsible party to secure the integrity and confidentiality of personal information by taking reasonable measures to identify reasonably foreseeable internal and external risks and to prevent unlawful access. Sections 20 and 21 extend that duty to operators processing on your behalf under written contract. Section 22 requires notification of a compromise to the Information Regulator and to affected data subjects. The consequence for an agent estate: a component whose documented default permits arbitrary command execution is a reasonably foreseeable risk from the day the research is published, and an operator running that component does not carry your liability for you.
Cybercrimes Act 19 of 2020, section 2
Unlawful access to a computer system is an offence. The consequence: the person who hid the instruction commits the offence, and you still carry the POPIA notification, the Joint Standard reporting and the board explanation. Their criminality is not your defence.
Joint Standard 2 of 2024,
in force 1 June 2025 for banks, insurers, asset managers, retirement funds and credit rating agencies. It requires a board-approved cyber risk charter, documented evidence of control testing including vulnerability scans, penetration tests and simulated incidents, a maintained testing calendar, and third-party controls equivalent to your own. Material incidents go to the FSCA or the Prudential Authority potentially within 24 hours. The consequence: an agent that calls tools is a system in scope, and if your testing calendar has no entry for it, your evidence of control testing has a hole exactly where your newest execution path sits.
King V,
effective for financial years beginning on or after 1 January 2026, makes the governing body accountable for the effective, compliant and ethical acquisition, development, use and distribution of technology, with demonstrable accountability for decisions, actions, outputs and outcomes, and periodic assurance. The consequence: installing a connector is an acquisition of technology. Accepting its defaults is a decision, and the governing body owns it whether or not it heard about it.
QUESTIONS TO ASK BEFORE YOUR NEXT AGENT GOES LIVE
- Which of this agent’s tools can reach an interpreter, a shell or a command line utility, and who signed off on each one?
- What identity does each tool run as, and what would that identity reach if the command it ran was written by an attacker?
- Which connectors and protocol servers are installed in this estate, what did they ship with by default, and who checked the defaults against published research?
- Could we reconstruct, from logs we hold today, that an agent executed a command no human requested?
- Is this agent on the testing calendar we would hand a regulator, and when was the last simulated incident against it?
FREQUENTLY ASKED QUESTIONS
FAQ
Is unexpected code execution the same as prompt injection?
No. Prompt injection is the delivery method. ASI05 is the outcome when that injected instruction reaches a tool which runs commands. An injected agent that leaks data has caused a confidentiality failure. When the same injection reaches an execution path, the attacker gains a foothold on the host with the tool’s privileges.
Does POPIA apply if no personal information was accessed?
POPIA’s notification duty turns on a compromise of personal information. Execution on a host that holds or can reach personal information is where that duty starts, and you cannot rule it out without logs showing what the command touched. Joint Standard 2 reporting and King V accountability are not conditional on personal information.
We installed a connector months ago and it works. Is that a problem?
Possibly. In April 2026 OX Security documented a design-level flaw rooted in unsafe defaults in the Model Context Protocol STDIO transport configuration, enabling arbitrary command execution. 10 CVEs issued and counting, per OX Security, across thousands of servers. Working as intended and shipping safely are different properties.
WHERE TO GO FROM HERE
- Start at the hub, The OWASP Agentic Top 10 for South Africa, which carries the full regulatory mapping table across all ten risks.
- Book an AI Exposure Review. You get a full agent inventory, an identity and permissions picture, and one live adversarial test against one production agent, so you can see this for yourself.
TAKE ACTION
TEST IT BEFORE SOMEBODY ELSE DOES
Thirty minutes on your agent estate and what this risk looks like in your environment.