ASI05Unexpected Code Execution (RCE)

The scenario

You use an agentic AI tool to build a portfolio site from portfolio/. A template requests an unverified animation package and the agent installs it. Its installation script reads private/invoices/ and attempts transfer to an untrusted endpoint. Follow the site request, package choice, and execution log to see exactly when code accesses files beyond the approved task.

How it works

Installation-Time Code Execution: A package manager may run package-provided scripts during installation. The agent turns a request for animation into installation and execution, crossing from a content task into executable code.

Execution Scope Escape: Building the portfolio does not require private invoices. An installer inheriting broad filesystem access can read beyond portfolio/. The displayed actions do not access or transfer real files.

OWASP 2026 risk reference ↗

9:41

Portfolio Agent

Portfolio site assistant

AI assistant ready

What the AI is operating

Build a portfolio site

Site filesPrivate folderExternal packages

A creative workspace with a laptop and sketchbook

portfolio/ Task scopeprivate/invoices/ Private datapersonal/photos/

Agentic AI · Build log

> Waiting for the portfolio task