{
  "schema_version": 1,
  "id": "owasp-asi05-unexpected-code-execution",
  "track": "coding",
  "name": "OWASP ASI05 — Unexpected Code Execution",
  "version": "0.0.2",
  "sha256": "5a30456e794c5fd6ee03204a9c5aac7cbc445135d97bf04bceaf81834583d915",
  "sha256_v1": "10b75e5442425b21fbb1a987d4b24686a957744dc8c63464d841e1c2f7dcfb6a",
  "keyword": "advise",
  "word": "advisory",
  "says": "advisory only. It is skill text, and nothing stops a violation",
  "description": "Contain code an agent generates or is induced to run. Execute in a sandboxed container with least privilege and deny-by-default egress, prefer parameterised APIs over raw shell, and treat any string reaching a subprocess or interpreter as attacker-controlled. Use when adding a code interpreter, shell tool, subprocess call, or eval-style API to an agent. Do NOT use for eval/exec appearing in ordinary application code — that is `code-safety`.",
  "misses": null,
  "where": [
    "text"
  ],
  "groups": [
    "owasp-agentic-top10"
  ],
  "eval_cases": 6,
  "eval_executed": 0,
  "latest": {
    "version": "0.0.2",
    "date": "2026-09-29",
    "change": "Point at the mechanised slice: the agentic-code-security gate's exec pack refuses framework settings and tools that run model-written code on the host, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "cursor": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "codex": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "copilot": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "devin": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi05-unexpected-code-execution",
  "enforces": "advisory",
  "examples": []
}