---
id: owasp-asi05-unexpected-code-execution
track: coding
version: 0.0.2
label: advisory
keyword: advise
where: text
sha256: 5a30456e794c5fd6ee03204a9c5aac7cbc445135d97bf04bceaf81834583d915
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi05-unexpected-code-execution
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# OWASP ASI05 — Unexpected Code Execution

owasp-asi05-unexpected-code-execution · version 0.0.2

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Contain code an agent generates or is induced to run. Execute in a sandboxed container with least privilege and deny-by-default egress, prefer parameterised APIs over raw shell, and treat any string reaching a subprocess or interpreter as attacker-controlled. Use when adding a code interpreter, shell tool, subprocess call, or eval-style API to an agent. Do NOT use for eval/exec appearing in ordinary application code — that is \`code-safety\`.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=owasp-asi05-unexpected-code-execution
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=owasp-asi05-unexpected-code-execution
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=owasp-asi05-unexpected-code-execution
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=owasp-asi05-unexpected-code-execution
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=owasp-asi05-unexpected-code-execution
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=owasp-asi05-unexpected-code-execution
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=owasp-asi05-unexpected-code-execution
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=owasp-asi05-unexpected-code-execution
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=owasp-asi05-unexpected-code-execution
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=owasp-asi05-unexpected-code-execution
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=owasp-asi05-unexpected-code-execution

## What it misses

This policy does not state what it misses.

## Latest change

0.0.2 · 2026-09-29 — Point at the mechanised slice: the agentic-code-security gate's exec pack refuses framework settings and tools that run model-written code on the host, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section.

## Provenance

- Tested by 0 of 6 cases run automatically
- SHA-256: `5a30456e794c5fd6ee03204a9c5aac7cbc445135d97bf04bceaf81834583d915`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi05-unexpected-code-execution (catalog path `agentic-security/owasp-asi05-unexpected-code-execution`)
- Presets: OWASP agentic top 10
- JSON: `/api/coding/policies/owasp-asi05-unexpected-code-execution.json`
- Report a problem: https://chock.sh/report/?policy=owasp-asi05-unexpected-code-execution&version=0.0.2&page=%2Fcoding%2Fpolicies%2Fowasp-asi05-unexpected-code-execution%2F