A side effect is any external action a system causes beyond producing its main output. In security terms, that can mean submitting a form, sending a request, modifying a file, changing a service state, or triggering an API call. The key idea is that the action happens outside the program itself and can affect other systems.
Side effects matter because they turn computation into action. A harmless-looking read-only task can become risky if a tool-enabled app, script, or AI agent can click links, post data, or invoke a webhook. Attackers may abuse side effects through prompt injection, CSRF, or unsafe automation to make a trusted system perform unwanted changes. Defenders reduce the risk with least privilege, explicit confirmation for state-changing actions, isolated test endpoints, and logging that spots unexpected requests or repeated retries.