T20 · Helmwart ID · OWASP MAS Guide source
An attacker exploits a security flaw in the agent framework software itself to run arbitrary code inside the agent's process.
Extends T11: Unexpected RCE and Code Attacks · base threat in OWASP v1.1 catalog
A vulnerability in the agent framework allows code injection into the agent’s execution context. This is the framework-layer manifestation of T11 Unexpected Remote Code Execution (RCE) and Code Attacks. Where T11 focuses on LLM-generated code paths, T20 targets a security flaw in the framework software itself, exploited to execute arbitrary code within the agent’s process.
In the RPA expense reimbursement context: an attacker identifies a deserialization vulnerability in the agent framework’s inter-agent message handler. A crafted malformed JSON-RPC message causes the framework to execute arbitrary code, granting the attacker the agent’s full process permissions: access to the financial system API credentials, the email integration, and the audit log.
In the ElizaOS (an open-source multi-agent operating system built on Solana) context: the framework vulnerability is the entry point for T11-class RCE, exploited through plugin loading or message handling that runs without adequate sandboxing. Because ElizaOS agents hold Solana wallet keys and on-chain transaction authority, framework-level RCE translates directly into wallet key exfiltration.
Agent frameworks run with the same broad credentials the agent uses to access all its integrated systems. A code injection at the framework layer grants the attacker those permissions immediately, without further privilege escalation. In a multi-agent deployment, the compromised framework process has network access to peer agents and shared message buses, enabling lateral movement through the agent fleet. T31 (Insufficient Isolation Between Agent Actions) compounds the risk: if agents share a runtime, a single compromised process can reach another agent’s key material through shared memory.
Framework-layer code injection produces distinctive runtime anomalies: processes that spawn unexpected child processes, access credential files they have never touched before, or emit unusual outbound network connections.
sh, python, or any interpreter not listed in the framework’s expected process tree): monitor via OS-level process-creation events (Linux execve audit rule or macOS EndpointSecurity) and alert on any unexpected child PID.credentials.json, .env, or any path in the secrets mount) from the framework’s message-handler thread, when no scheduled credential refresh is in progress. Alert on any such access outside the defined refresh window.T20 extends T11 Unexpected RCE and Code Attacks. T11 addresses LLM-generated malicious code; T20 addresses the framework layer as an independent injection surface. T29 (Plugin Vulnerability Leading to Agent Compromise) is the companion threat in the ElizaOS context where the injection vector is a third-party plugin rather than the framework message handler.
The Agentic Top 10 (ASI01 through ASI10) is a separate practitioner-facing publication that maps onto the master Threats & Mitigations threat numbering. T20 is covered by the following Top 10 entries:
Third-party components that agents depend on (models, MCP servers, plug-ins, datasets, peer-agent descriptors, and update channels) may be malicious, compromised post-approval, or tampered with in transit. Unlike software supply-chain risk, this is a live exposure: every new session the agent fetches and trusts components whose state may have changed since they were last reviewed.
In an agentic system, code generation and code execution happen in the same turn: the model emits an instruction and a tool runs it, with no human review step between. Attackers exploit this by injecting execution payloads into the agent's inputs; the realistic defence is at the runtime boundary (sandboxing, capability restriction, egress control), not at the generation step.
Source: OWASP Top 10 for Agentic Applications 2026 (Dec 2025) · the Top 10 is a compass into the master Threats & Mitigations taxonomy, not a replacement for it.
When T20 is present, these security design principles are the ones being violated or tested. Each links to the full principle; the mitigations below are how you restore them.
Auto-generated from the mitigation catalog: every mitigation whose coverage map includes T20, sorted by maturity tier (Tier 1 production-canonical first, then Tier 2, then Tier 3 research-stage).
An AI agent assembles itself at runtime from a model, prompt templates, plugins, and library dependencies, any of which can be tampered with before they arrive. A signed AI Bill of Materials (AIBOM) locks down that assembly: it records every component with a version and hash at build time, signs the manifest, and verifies it before the agent accepts traffic. A component that does not match its declared hash cannot silently enter the agent.
why it helps Framework Vulnerability Leading to Code Injection needs a vulnerable framework version to be present and unnoticed. A signed AIBOM makes the version of every framework and library the agent loads explicit and pinned, so a published advisory maps to a concrete deployment instead of a question, and a swapped binary fails its hash. It does not fix a vulnerability you have decided to keep running.
When an agent executes generated or retrieved code, that code runs as a process with access to the host kernel. A vulnerability in the generated code, or a deliberate exploit injected through the agent's prompt, can reach the kernel and affect other workloads or the host itself. A kernel-isolated sandbox removes that path by giving the workload a kernel of its own: gVisor interposes a user-space kernel so syscalls reach the Sentry rather than the host, and Kata Containers runs the pod in a lightweight VM with a separate kernel. Which one is available is a property of the platform, not of the control — AKS ships Kata as Pod Sandboxing and does not support gVisor; GKE ships gVisor.
why it helps Framework vulnerability exploitation requires that malicious code running inside the agent's execution environment can reach the host OS or interact with other workloads. gVisor's syscall interception boundary limits that reach: code exploiting an unpatched framework vulnerability runs inside the Sentry's isolation layer, and the set of host operations it can invoke is restricted to those the Sentry forwards.
An AI coding agent produces code that can be executed or merged to a production branch without a human ever reading it. If the agent has been manipulated, its generated code can contain hidden payloads, backdoors, or privilege-escalating logic. A code-generation review gate prevents that: every change attributable to an AI agent must pass automated static analysis and receive explicit human approval before it can merge or execute, and the agent identity that authored the change is structurally barred from also approving it.
why it helps OWASP T20 Framework Vulnerability Code Injection is the scenario where an agent is caused to generate code that calls a known-vulnerable framework API. SAST scanning of AI-attributed diffs detects known-vulnerable patterns before merge; human review catches semantic-level injection that SAST cannot, such as code that looks structurally correct but exfiltrates data through a misconfigured output.
MITRE ATLAS catalogues adversary techniques against AI systems. Where this OWASP threat has an attacker-perspective counterpart, the ATLAS technique is shown below. That is what a red team would actually be doing on the wire. Use this for detection-signal anchoring, threat-hunting hypotheses, and IR runbooks. Source: mitre-atlas/atlas-data v2026.09.
© 2026 The MITRE Corporation. ATLAS content is reproduced and distributed with the permission of The MITRE Corporation.
AML.T0049
Exploit Public-Facing Application
view on ATLAS ↗
Adversary exploits a vulnerability in an internet-facing service to gain initial access. For AI systems this often means the inference API or its surrounding web application.
AML.T0050
Command and Scripting Interpreter
view on ATLAS ↗
Adversary executes commands, scripts, or binaries via a legitimate interpreter the system already exposes (Python, shell, JavaScript).
Agentic angle: Code-executing agents and "vibe-coding" tools turn this into a routine path for attackers. A single prompt injection can pivot to RCE.
AML.T0072
Cyber Communication Channel
view on ATLAS ↗
Adversary establishes or uses a channel for command and control over any protocol, service, repository or relay, synchronously or asynchronously. ATLAS points at the ATT&CK Command and Control tactic for the specific protocols.
Agentic angle: A code-executing agent that hits a malicious tool can be coerced into opening one — a reverse shell is the loudest case, but an agent polling an attacker-controlled repository is the same technique and looks like ordinary traffic.
Adapted by Helmwart from the OWASP source(s) above under CC BY-SA 4.0 (changes: normalized IDs, added MAESTRO-layer, agentic-factor, and mitigation mappings). This entry is licensed CC BY-SA 4.0.
Press play. The voice downloads once, then it’s cached.
On-device · private