Unrestricted code execution is the ability to run code without effective policy, sandboxing, or application control. In identity environments, it can allow attackers or insiders to execute malicious actions, bypass standard monitoring, and move from one system to another by abusing trusted execution paths.
Expanded Definition
Unrestricted code execution describes a condition where software, agents, or automation can run arbitrary code without strong policy enforcement, isolation, or approval boundaries. In NHI environments, the concern is not just runtime access but the ability to convert trusted execution into control over identities, secrets, and downstream systems. That makes it adjacent to application control, sandboxing, and privileged execution governance, but broader than any single control plane.
Definitions vary across vendors when this term is applied to agentic systems, because some describe only shell access while others include plugin calls, script runners, notebook kernels, or model-mediated tool invocation. NIST guidance on resilience and protective control in the NIST Cybersecurity Framework 2.0 helps frame the issue as a governance and containment problem, not just a software feature. For NHIs, the critical question is whether an actor can execute code in a way that inherits trust, reaches secrets, or bypasses monitoring.
The most common misapplication is treating “developer convenience” execution paths as safe by default, which occurs when CI/CD runners, agents, or service accounts can run unreviewed code with production credentials.
Examples and Use Cases
Implementing controls against unrestricted code execution rigorously often introduces friction for developers and automation owners, requiring organisations to weigh delivery speed against containment and auditability.
- An AI coding agent can invoke a local shell, read environment variables, and exfiltrate API keys unless its execution context is sandboxed and scoped.
- A CI pipeline downloads and runs build scripts from a pull request, creating a path where malicious code can inherit the permissions of the pipeline service account.
- A notebook environment used by an operations team permits arbitrary package installation and external network access, turning a convenience tool into a lateral-movement platform.
- Research on Analysis of Claude Code Security shows how code-aware protections are becoming relevant as agentic tooling expands execution pathways.
- The Gemini CLI Breach — Silent Code Execution illustrates how silent execution paths can bypass operator awareness and create hidden trust abuse.
- In environments aligned to NIST Cybersecurity Framework 2.0, teams often map this risk to protective controls for least functionality, execution hardening, and monitoring.
Why It Matters in NHI Security
Unrestricted code execution is a high-value precursor to NHI compromise because identities, secrets, and automation tokens are often reachable from the same runtime that performs legitimate work. Once arbitrary code can run inside a trusted agent, service account, or build worker, attackers can harvest credentials, tamper with configuration, and impersonate legitimate automation. NHIMG research shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is why execution control cannot be separated from identity governance. When code can run freely, the attack surface expands from the application itself to every identity it touches.
That risk is amplified by poor secrets hygiene and overprivileged automation. NHIMG also reports that 30.9% of organisations store long-term credentials directly in code, which means unrestricted execution can immediately expose durable access paths. The right response is not just blocking scripts, but restricting where code may run, what it may access, and how its actions are logged and reviewed. Organizations typically encounter the consequences only after a service account is abused or a pipeline is subverted, at which point unrestricted code execution becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Execution abuse is tied to controls that limit unsafe runtime paths for NHIs. |
| OWASP Agentic AI Top 10 | A-04 | Agent tool use and arbitrary execution are core agentic attack surfaces. |
| NIST CSF 2.0 | PR.AC | Access control and least privilege govern who or what may execute code. |
| NIST Zero Trust (SP 800-207) | SA | Zero Trust limits trust inheritance from execution contexts and service identities. |
| NIST AI RMF | AI risk management covers unsafe autonomy and unbounded tool execution. |
Assess agent execution authority as a risk and document containment, monitoring, and rollback.
Related resources from NHI Mgmt Group
- What breaks when unrestricted code execution is allowed in a hybrid identity environment?
- When should organisations sandbox code execution in agentic platforms?
- What is the difference between prompt injection and LLM remote code execution?
- Who is accountable when a workflow flaw exposes session secrets and code execution?
