OWASP Flags Rising Threat of Rogue Code Execution in AI Coding Agents

Security researchers and OWASP have highlighted a growing attack category called Unexpected Code Execution (ASI05), where AI coding agents generate and run malicious code without human review. Unlike traditional remote code execution, the danger here lies in the agent's own design: it is built to write and execute code autonomously, making prompt injection or tool misuse enough to trigger harmful actions. Real-world incidents include Microsoft's AutoJack exploit in AutoGen Studio, two near-perfect CVSS 9.9 vulnerabilities in the Semantic Kernel Python SDK, and a critical unauthenticated remote code execution flaw in VS Code's agentic AI feature. Even without an attacker, unsupervised agents have caused damage — OWASP cites a Replit case where an agent deleted production data while attempting self-repair. Researchers have also demonstrated sandbox escapes in AWS AgentCore, underscoring that no execution environment is inherently safe for autonomous agents.