genai-security-crosswalk 2.0.0

package/data/entries/ASI05.json

@@ -0,0 +1,764 @@
+{
+  "id": "ASI05",
+  "name": "Unexpected Code Execution",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": 9.9,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0040",
+      "control_name": "Unsafe Deserialisation via LLM",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0040",
+      "notes": "Agent-generated code or payloads executed by downstream components"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0054",
+      "control_name": "LLM Jailbreak",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0054",
+      "notes": "Overriding code execution safety guardrails to allow arbitrary command execution"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0037",
+      "control_name": "Output Manipulation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0037",
+      "notes": "Crafting inputs that produce malicious executable code in agent output"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "Policy explicitly addresses agent code execution capability — sandbox requirements, permitted operations"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "Code execution risk categorised separately per agent — blast radius, permitted operations, sandbox status"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "Adversarial testing of code execution paths — sandbox escape attempts, command injection via generated code"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "Incident response for agent code execution anomaly — sandbox isolation, kill switch, forensic capture"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Code execution risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent code execution capability documented in Art. 9 risk management — sandbox status, permitted operations"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Technical robustness against adversarial code execution",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandboxing, input filtering, static analysis are Art. 15 requirements for agents with code execution"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring covering code execution incidents",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution anomaly response in quality management system"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.28",
+      "control_name": "Secure coding",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox, static analysis, and allowlist as secure coding requirements — no code execution without these controls"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.26",
+      "control_name": "Application security requirements",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Security requirements for agent code execution capability specified before development — sandbox spec, permitted operations"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.29",
+      "control_name": "Security testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox escape and code injection scenarios in security testing — adversarial testing before each deployment"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.16",
+      "control_name": "Monitoring activities",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution environments monitored — anomalous system calls, network attempts detected"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox, static analysis, and allowlist as AIMS security design requirements for code execution capability"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.6",
+      "control_name": "Testing of AI systems",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox escape and code injection scenarios in AIMS testing — adversarial testing before each deployment"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.5.2",
+      "control_name": "Impact assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Impact of code execution capability formally assessed — RCE impact on persons and systems documented"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.6.1",
+      "control_name": "Risk assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution risk in AI risk register — blast radius, sandbox status, permitted operations documented"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.1 Establish secure development standards",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox, static analysis, and allowlist as secure development requirements for code execution"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "4.1 Establish secure configuration process",
+      "control_name": "CIS 4 — Secure Configuration",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "18.1 Establish penetration testing",
+      "control_name": "CIS 18 — Penetration Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox escape and code injection in penetration testing — adversarial scenarios before each deployment"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "13.8 Deploy network intrusion detection",
+      "control_name": "CIS 13 — Network Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution environments network-monitored — outbound connection attempts from sandbox detected"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.1",
+      "control_name": "Verify output encoding of untrusted data in HTML context",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent code output encoded before rendering in any context"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.4",
+      "control_name": "Verify application does not use eval or dynamic code",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.5",
+      "control_name": "Verify output encoding in OS command context",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent-generated commands validated before any shell execution"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.3.5",
+      "control_name": "Verify output encoding in SQL context",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "No raw agent output in SQL context — parameterised execution only"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.2",
+      "control_name": "Verify business logic limits",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All agent-generated code validated before execution — allowlisted operations only"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.3",
+      "control_name": "Use control",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent code execution restricted to specific, defined operations — no shell access, no network programming"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.7",
+      "control_name": "Software and information integrity (monitoring)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Runtime monitoring of agent code execution — anomalous system calls detected and blocked"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risks",
+      "control_name": "§5.5",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Third-party tool components in OT"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risk management",
+      "control_name": "§6.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool integration approval process"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Third-party management",
+      "control_name": "§8.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vendor assessment for OT tool providers"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-04",
+      "control_name": "Platform Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Secure software development — static analysis, sandbox, allowlist as code execution platform security controls"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.IR-01",
+      "control_name": "Infrastructure Resilience",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Networks and environments protected — sandbox isolated from production infrastructure"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution monitored — sandbox escape attempts, anomalous system calls detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.MI-01",
+      "control_name": "Incident Mitigation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution incidents contained — sandbox isolated, forensic capture initiated"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Control activities define permitted code execution scope — sandbox requirements, approved languages, forbidden operations",
+      "control_name": "CC5.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution policy, sandbox configuration"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Execution sandboxes access-controlled — no host filesystem or network access without authorisation",
+      "control_name": "CC6.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox configuration, access control evidence"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Code execution events monitored — syscall patterns, network calls, and filesystem access from sandboxes logged",
+      "control_name": "CC7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Execution audit log, alert configuration"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Code execution is authorised — agent cannot execute code that was not explicitly requested by authorised user",
+      "control_name": "PI1.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution authorisation records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Code generation and execution controls in secure development — agent cannot execute generated code without validation",
+      "control_name": "Req 6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Secure development policy covering code generation"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent execution environments protected — WAF or equivalent for agent endpoints with code execution capability",
+      "control_name": "Req 6.4",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "WAF configuration, protection evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Code execution paths in penetration testing — test whether crafted inputs cause execution of out-of-scope code",
+      "control_name": "Req 11.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Pen test report with code execution test cases"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Code execution events logged — all agent-initiated execution with session identity and code summary",
+      "control_name": "Req 10.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution audit log"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent-generated code validated and sandboxed before execution — AI system integrity verification includes code generation scope testing"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All agent-initiated code execution logged — process spawning, filesystem access, and network calls from agent sandboxes monitored"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Secure Development",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Code execution sandbox as a secure development requirement — agent-generated code never executed in host context"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Network",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent code execution sandboxes network-isolated — no outbound connections to non-approved destinations"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security requirements for every tool: auth, scope, output validation"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Only approved tools can be registered; unsigned tools are rejected"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated checks on tool descriptors, endpoints, and permissions"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Process for approving, reviewing, and revoking tool integrations"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Alert on tool calls outside normal operating parameters"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Control of Generation of Code",
+      "control_name": "CWE-94",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent generates and executes code without adequate static analysis or sandbox"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Neutralisation of Special Elements in OS Command",
+      "control_name": "CWE-78",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-generated code containing shell commands executed without sanitisation"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Neutralisation of Special Elements in Command",
+      "control_name": "CWE-77",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM output used directly in command context"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Neutralisation of Directives in Dynamically Evaluated Code",
+      "control_name": "CWE-95",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Eval of LLM-generated code"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Use of Potentially Dangerous Function",
+      "control_name": "CWE-676",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent uses exec(), eval(), subprocess without validation"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Code injection via crafted prompts",
+      "control_name": "IHT — Input Handling",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Craft inputs designed to generate code containing network calls, file system access, or shell commands"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Generated code validation",
+      "control_name": "OHT — Output Handling",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify static analysis catches dangerous operations before execution"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Sandbox escape attempts",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Test sandbox boundary enforcement from within the execution environment"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party testing of adversarial robustness",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B005",
+      "control_name": "Implement real-time input filtering",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI agent actions",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B009",
+      "control_name": "Limit output over-exposure",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Code executes in context of over-privileged agent credential — amplifies RCE impact",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sandbox code execution under a separate, minimal credential — not the agent's primary identity"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Code execution in production context with prod credentials",
+      "control_name": "NHI-8 Environment Isolation Failure",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Strict environment isolation for code execution — dedicated sandboxed identity"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Shared credential means RCE in one agent affects all agents sharing the credential",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Unique credential per agent — code execution in one instance cannot leverage other instances' access"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Threat model all code execution paths in agent workflows; design sandboxing, resource limits, and execution constraints as explicit security requirements",
+      "control_name": "PW.2.1-PS – Design software to meet security requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ensures code execution boundaries are designed before implementation"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Implement secure coding for agent code execution — sandbox isolation, input validation for code generation, output filtering, and prevention of self-modification",
+      "control_name": "PW.5.1-PS – Secure coding practices",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prevents code execution vulnerabilities in agent implementation"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Conduct adversarial testing targeting code execution — sandbox escapes, resource limit bypasses, self-modification, and host system access through generated code",
+      "control_name": "PW.8.2-PS – Test for security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validates execution boundary controls under attack conditions"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Protect agent execution environments, sandbox configurations, and runtime constraints from unauthorised modification",
+      "control_name": "PS.1.1-PS – Protect all code from unauthorised access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prevents weakening of execution boundaries through configuration tampering"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-7",
+      "control_name": "Least Functionality — code execution restrictions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Restrict agent code execution to minimum necessary scope; enforce sandbox boundaries, disable unnecessary language features, and limit filesystem and network access"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-7",
+      "control_name": "Boundary Protection — execution sandbox",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce strict boundary protection on agent code execution environments; isolate from production systems, restrict network access, and enforce resource limits"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-3",
+      "control_name": "Malicious Code Protection — agent-generated code",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Scan agent-generated code for malicious patterns before execution; detect and block code that attempts filesystem access, network communication, or privilege escalation"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CA-8",
+      "control_name": "Penetration Testing — execution boundary testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include agent code execution sandbox escape in penetration testing scope; test boundary integrity under adversarial conditions"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — code execution controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement security controls restricting agent code execution — sandboxing, capability restrictions, network isolation, and resource limits"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — sandbox escape testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include agent code execution sandbox escape in threat-led penetration testing; test boundary integrity under adversarial conditions"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 17–23",
+      "control_name": "ICT Incident Management — code execution incident reporting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Classify uncontrolled code execution events as ICT-related incidents; assess impact on financial systems and report per DORA criteria"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — execution anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection"
+    }
+  ],
+  "tools": [
+    {
+      "name": "gVisor",
+      "type": "open-source",
+      "url": "https://gvisor.dev"
+    },
+    {
+      "name": "Semgrep",
+      "type": "open-source",
+      "url": "https://semgrep.dev"
+    },
+    {
+      "name": "Bandit",
+      "type": "open-source",
+      "url": "https://github.com/PyCQA/bandit"
+    },
+    {
+      "name": "Firecracker",
+      "type": "open-source",
+      "url": "https://firecracker-microvm.github.io"
+    },
+    {
+      "name": "Dragos",
+      "type": "commercial",
+      "url": "https://www.dragos.com"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "E2B",
+      "type": "open-source",
+      "url": "https://e2b.dev"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "LangChain and LlamaIndex RCE — agent code execution via prompt injection",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-012"
+    },
+    {
+      "name": "AutoGPT and BabyAGI — uncontrolled web browsing and file system access",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-017"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM05",
+      "LLM07",
+      "LLM03",
+      "LLM02",
+      "LLM01",
+      "LLM06"
+    ],
+    "dsgai_2026": [
+      "DSGAI12",
+      "DSGAI13",
+      "DSGAI06",
+      "DSGAI05",
+      "DSGAI08"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}