# LLM output executed as code

LLM-generated SQL, Cypher, shell or code reaching an executor guarded only by regex or blocklist

_Area: AI and LLM app security. Seen in 4 disclosed reports; latest 2026-08-19. Updated 2026-10-25._

## How it works
A model's output is treated as trusted code. User text (or tool output) reaches a prompt, the model emits a query, script, or SDK option, and the app hands that straight to an executor. The broken assumption is that a filter can make model output safe. Regex and blocklists match known strings; the model can produce equivalent constructs the filter never enumerated, and the executor has no notion of intent.

## Where it shows up
- LLM response assigned to a variable like `pythonCode`, `cypher_query`, or `sql` and passed to `exec`, `session.run`, `tx.run`, or a subprocess.
- Guard is a static regex/blocklist (`_DANGEROUS_SQL_PATTERNS`, `validatePythonCodeForDataFrame`) rather than an allowlist or sandbox.
- MCP/agent tools that spread raw LLM args (`...args`) into a third-party SDK's options.
- Schema fields named `host`, `baseURL`, `proxy`, `insecure`, `rawProxy` that the model can set.
- Sibling modules of an already-patched sink (e.g. a Cypher agent next to a fixed SQL agent) with no validator.

## How to review
Find every place model output reaches an executor. The invariant: model output must never reach a sink with ambient authority. Either the sink is sandboxed with no host access, or the operation is constrained by an allowlist (statement type, function names, pinned host) that the model cannot widen. Check that credentials and endpoints are pinned by the tool, not taken from LLM args [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2xhg-73j7-rrgx.md). Check that blocklists cover whole function families, not exact tokens [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-pmch-g965-grmr.md). Check that a fix in one query-language agent was applied to its siblings [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2pq5-3q89-j7cc.md). Check that code execution is isolated from the host OS, not just filtered [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5xvg-pmgg-3mxr.md).

## Variants seen
- LLM-controlled `host`/`proxy` spread into an SDK client, exfiltrating the server's PAT [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2xhg-73j7-rrgx.md).
- Prompt injection to Python, bypassing a regex blocklist, running unsandboxed in pyodide for RCE [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5xvg-pmgg-3mxr.md).
- LLM-generated Cypher passed to `session.run` with no allowlist, reaching RCE via APOC [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2pq5-3q89-j7cc.md).
- SQL blocklist missing the `pg_read_file`/`pg_stat_file`/`pg_ls_*` family, enabling arbitrary file read [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-pmch-g965-grmr.md).

## Why fixes fail
Fixes are scoped to the reported sink. The SQL agent got a validator and `allow_dangerous_operations` gate, but the Neo4j agent was left unguarded [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2pq5-3q89-j7cc.md). The SQL blocklist enumerated exact names and missed siblings on the same primitive [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-pmch-g965-grmr.md). Regex guards are bypassable by identifier reconstruction [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5xvg-pmgg-3mxr.md).

## Impact and severity
Ranges from credential theft [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2xhg-73j7-rrgx.md) and arbitrary file read [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-pmch-g965-grmr.md) to full RCE as the server user [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5xvg-pmgg-3mxr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2pq5-3q89-j7cc.md). Severity is high because the executor runs with the app's privileges; it worsens when the sandbox shares the host OS [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5xvg-pmgg-3mxr.md) and when dangerous procedures (APOC) are enabled [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2pq5-3q89-j7cc.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-2xhg-73j7-rrgx.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-5xvg-pmgg-3mxr.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-2pq5-3q89-j7cc.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-pmch-g965-grmr.md