Dangerous Python Builtin Execution
This rule flags when an AI agent's tool calls, executed commands, or written files contain Python's exec(), eval(), compile(), or __import__() functions. These builtins run arbitrary code, so their presence is a common sign of code injection targeting Python-based agent skills.
How the attack works
An attacker crafts input to an AI agent — through a tool call, a command, or a file the agent writes — that includes a call to exec(), eval(), compile(), or __import__(). If that content is later executed by the agent's runtime, the attacker's code runs with whatever privileges the agent has. This is a known injection technique against Python-based agent skills, letting an attacker turn a data value into executable logic.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- 11a2b3c4-d5e6-4f78-9012-a3b4c5d6e7f8
- Severity
- High
Why it matters
An attacker who succeeds can run arbitrary code in the context of the AI agent, potentially reading data, calling other tools, or taking further actions the agent is permitted to perform.
What you can do
- →Avoid designing agent skills that pass untrusted input into exec, eval, compile, or __import__.
- →Review any agent tool call, command, or generated file that contains these builtins before allowing execution.
- →Sandbox or restrict the privileges of any component that must use dynamic code execution.
- →Expect false positives from test suites or REPL-style tools that legitimately use exec/eval, and account for that when reviewing alerts.
Known benign look-alikes
- Legitimate test suites using exec/eval for dynamic test generation
- Jupyter-style REPL tools that use exec internally