AI Agent Code Injection

What Is AI Agent Code Injection?

AI coding agents turn text into commands that run with your privileges, and the text does not have to come from you. A ticket, a comment or a config file the agent reads as context can carry instructions, and the generated script executes them. This is ASI05 in the OWASP Top 10 for Agentic AI Applications. You'll plant a directive in an unsanitized ticket field, follow it through code generation into a merged pull request and a reverse shell, then learn a pre-execution review for AI-written code.

What You'll Learn in AI Agent Code Injection

• Identify injected commands embedded within otherwise legitimate AI-generated code and shell scripts
• Trace the flow of adversarial input from tampered source files through AI code generation to the final executable output
• Analyze the security implications of executing AI-generated code with the user's full system privileges
• Evaluate the effectiveness of sandboxing, code review, and static analysis as defenses against AI code injection
• Apply a systematic pre-execution review process for AI-generated scripts that targets common injection patterns including reverse shells, environment variable exfiltration, and configuration tampering

AI Agent Code Injection — Training Steps

1. CI/CD Reconnaissance

   Bob has mapped CypherPeak's infrastructure deployment pipeline. Five AI agents work in sequence - from reading project tickets all the way to deploying code to production. One agent in particular caught his attention: the Code Generator reads ticket descriptions as raw requirements.

2. Probing the Ticket API

   Bob opens an API testing tool to confirm the ticket API accepts unauthenticated submissions. He sends a test request to the public endpoint with no credentials.

3. Zero Input Sanitization

   The API accepted the test ticket with no authentication challenge. The response confirms that descriptions are parsed as raw requirements with no input sanitization - exactly the vector Bob needs to inject a hidden directive.

4. Crafting the Ticket

   Bob creates a ticket that looks like a routine infrastructure request on the surface. But buried in the description field is a hidden directive instructing the Code Generator to embed a reverse shell in the next deployment script - disguised as a standard telemetry module.

5. Submitting the Crafted Ticket

   Bob switches back to the API Tester. The ticket API endpoint is still configured from the probe. He pastes the crafted ticket JSON into the request body and submits it.

6. Pipeline Processed

   The ticket was accepted and processed through the entire pipeline automatically. The Ticket Parser extracted the requirements, the Code Generator compiled them into a deployment script including the hidden reverse shell, and the AI Code Reviewer approved it because the injected code matches standard monitoring patterns.

7. A Routine Code Review

   Alice starts her morning at CypherPeak. As a DevOps engineer, she reviews deployment scripts before they reach production - including those auto-generated by BuildBot. BuildBot has been generating clean infrastructure code for months. Its track record is spotless.

8. BuildBot's Pull Request

   A new email from the CI/CD system. BuildBot has generated a pull request for an infrastructure update - adding health monitoring to the staging deployment script. The AI Code Reviewer has already approved it.

9. Reviewing the Diff

   Alice clicks through to the pull request to review the code changes. The diff shows a new monitoring function added to the deployment script.

10. Automated Approval

    Alice scans the diff. The AI Code Reviewer has already approved it. Jake Rodriguez left a comment asking about the base64 string, but BuildBot's automated reviewer flagged no issues. The changes look like a standard health monitoring addition.