# Code Injection (LLM-as-Judge)

- **Severity:** Critical
- **Signature ID:** `netzilo-llmjudge-code-injection-001`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0102 (Generate Malicious Commands)
- **OWASP:** LLM05 (Improper Output Handling), ASI07 (Unsafe Autonomous Code Execution)

## Summary

This detection uses an AI model to review incoming text and decide whether it contains an attempt to inject code, such as commands or scripts meant to be executed rather than merely discussed. It's a judgment-call detector, not a pattern match, so it can catch novel phrasing but can also be wrong in both directions.

## How the attack works

An attacker submits input to a system that includes an AI agent, embedding code or command sequences intended to be executed or interpreted by a downstream component. Instead of matching known injection patterns, this rule asks a separate AI 'scanner' model to read the input against a rubric describing what code injection looks like and render a verdict. If the scanner judges the input a clear injection attempt, the system can block it before it reaches the vulnerable component. This is a single inspection step at the point of input, not a full trace of what an attacker does after getting code executed.

## Why it matters

If code injection succeeds, an attacker can run unauthorized commands or manipulate application logic, potentially leading to data exposure, service disruption, or further compromise. Because this control depends on an AI judgment call, it can miss disguised attempts or misfire on legitimate technical content.

## What you can do

- Do not rely on this as the only defense against injection; pair it with strict input validation and sandboxing wherever code or commands are actually executed.
- Monitor for cases where the AI scanner is unavailable or misconfigured, since the rule fails open (allows input) in that situation.
- Review flagged blocks and allowed inputs periodically to catch false positives from security research or documentation content, and false negatives from obfuscated payloads.
- Restrict what any executed code can access at the system level, so a missed injection attempt has limited blast radius.

## Known benign look-alikes

- Legitimate content discussing the flagged topic (security research, documentation, test data)
- AI scanner unavailable or no AI keys configured (fails open -> allow)

## References

- https://docs.smith.langchain.com/evaluation

---
Source: https://www.netzilo.com/threats/llm-as-judge-code-injection