Remote code execution
Also called RCE, arbitrary code execution
A flaw that lets someone run their own code on your machine over a network, without sitting at it.
Most security flaws give an attacker one thing: a file they shouldn't read, or a page they shouldn't see. Remote code execution gives them the machine. They send something over the network, and the target runs their code as if its owner had typed it.
From there the rest follows. Code running on a server can read its files and its keys, install more software, and reach whatever that server can reach.
AI software has opened new routes to it. Agent frameworks and workflow builders include steps that run code on purpose, so a crafted workflow file, or an injected prompt, can become a command on the server. The same goes for an app that hands a model's output to something that executes it. For that reason a tool that runs code belongs in a sandbox, and the software around your models belongs on the list you patch first.
For example
A workflow builder has a step that runs code. An outsider sends it a crafted workflow file, the step runs their commands, and the server is now theirs.
Put it to use
Where you'll meet remote code execution in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.