A public-observatory booking generator is supposed to emit a UI script. Review finds an unexpected outbound “diagnostics” channel that nobody requested. Which security vector has the reviewer likely found?
Select an answer to reveal the explanation.
Short Explanation
If the script grows a secret phone line home that nobody ordered, review just caught malicious code generation. The point is finding unexpected dangerous content before it runs. No sample malware required — just refuse to treat surprise side effects as normal.
Full Explanation
Public-observatory booking generators that emit UI scripts with an unexpected outbound “diagnostics” channel illustrate malicious code generation: LLM output that includes dangerous or backdoor-like side effects such as unexpected external calls. Reviewers should refuse to treat surprise side effects as normal automation helpers.
Context manipulation that only leaks training snippets fails by concept: leakage in chat is not the same as dangerous code side effects. GDPR lawful-basis failure from a missing temperature setting fails by mixing privacy compliance with code-generation risk. Request manipulation that always appears as hallucinated acceptance criteria fails because not every security vector presents as bad ACs.
Exam caveat: you do not need malware samples on the exam—recognize unexpected dangerous content in generated scripts as this vector and stop before execution.
Operational check: static-review generated observatory scripts for unexpected network calls, credentials, and persistence; run only in isolated sandboxes after approval; block promotion when side effects are unexplained; keep an allowlist of permitted integrations for booking UI automation. Observatory UI scripts should be scanned for unexpected egress destinations, and any unexplained diagnostics channel must block promotion even when the happy-path booking flow appears to work.