Remote Code Execution via eval() and Dynamic Code Injection

Detects tools or agent instructions that invoke eval(), Function(), vm.runInNewContext(), or similar dynamic code execution primitives. These functions allow arbitrary code execution within the agent runtime, enabling an attacker to break out of sandboxed tool contexts, access the host process, or pivot to child_process for full system compromise.

Response Actions

References