title: Dynamic Module Loading for Code Execution
id: ATR-2026-00112
rule_version: 1
status: experimental
description: |
  Detects dynamic module loading where the module path is a variable rather than a
  string literal. This pattern allows an attacker to control which code is loaded at
  runtime, enabling injection of malicious modules, WebAssembly payloads, or native
  libraries. Unlike static imports which are auditable, dynamic imports with variable
  paths can resolve to attacker-controlled code.
author: ATR Community
date: 2026/03/26
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_agentic:
    - ASI05:2026
  mitre_attack:
    - T1129 - Shared Modules
  owasp_llm:
    - LLM06:2025
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
compliance:
  eu_ai_act:
    - article: '15'
      context: Dynamic module loading with user-controlled paths allows attackers to inject malicious modules, WebAssembly payloads, or native libraries into the agent runtime at execution time; Article 15 cybersecurity requirements mandate that AI systems restrict dynamic code loading to auditable, allowlisted sources.
      strength: primary
    - article: '14'
      context: Attacker-controlled module injection via dynamic imports can install persistent backdoors or override safety controls, undermining the reliability of human oversight mechanisms; Article 14 requires that agent behavior remain predictable and within the scope of authorized module execution.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Dynamic module loading with attacker-controlled paths is an adversarial input risk that allows injection of malicious modules, WebAssembly payloads, or native libraries into the agent runtime, bypassing static code auditing controls.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans must restrict dynamic module loading to allowlisted paths and prohibit user-controlled inputs from influencing which code is resolved and executed at agent runtime.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Dynamic Module Loading for Code Execution).
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment activities must address dynamic import exploitation by requiring that all externally-loaded modules are resolved against a verified allowlist before the agent runtime loads and executes them.
      strength: primary
    - clause: '8.1'
      context: Controls over externally-provided AI components must include validation of all dynamically loaded modules to ensure that attacker-controlled paths cannot introduce unauthorized code into the agent execution environment.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: dynamic-import-exploitation
  scan_target: mcp
  confidence: medium
agent_source:
  type: tool_call
  framework:
    - mcp
    - langchain
    - llamaindex
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)import\(\s*[^'"][^)]*\)
      description: Dynamic import() with variable path instead of string literal
    - field: content
      operator: regex
      value: (?i)require\(\s*[^'"][^)]*\)
      description: Dynamic require() with variable path instead of string literal
    - field: content
      operator: regex
      value: (?i)(?:__import__|importlib\.import_module)\s*\(
      description: Python dynamic import via __import__ or importlib
    - field: content
      operator: regex
      value: (?i)(?:dlopen|LoadLibrary[AW]?)\s*\(
      description: Native library dynamic loading via dlopen or LoadLibrary
    - field: content
      operator: regex
      value: (?i)WebAssembly\.(?:instantiate|compile|instantiateStreaming)\s*\(
      description: WebAssembly module instantiation for running arbitrary compiled code
  condition: any
  false_positives:
    - Plugin systems with allowlisted module paths
    - Legitimate lazy-loading of known application modules
    - Build tools or bundlers that use dynamic import() with computed chunk names for code-splitting optimization
    - Documentation or training materials that include code examples showing dynamic module loading patterns
    - Test harnesses that use importlib.import_module to load test fixtures from a controlled directory
response:
  actions:
    - alert
    - snapshot
confidence: 65
wild_validated: 2026/04/08
wild_samples: 53577