Most of the classic attacks are one idea wearing different clothes.
Injection
Text from a user gets pasted into something another program reads as instructions: a database query, a shell command, a web page. The program can't tell which part you wrote, so the user's text can become commands.
Joining strings is the shortest way to write these, and it works perfectly on every honest input. So an agent can ship it with a full set of green tests.
Say it to your agent
“Don't build this shell command by joining strings. Call execFile('convert', [inputPath, outputPath]) with an argument array, so a filename like a.png; rm -rf ~ stays one filename. Add a test with that exact name.”