An agent-to-controller callable is a Jenkins Remoting object that lets an agent ask the controller to execute a defined piece of code or logic and return a result. It is part of the normal controller-agent communication model, where the controller coordinates builds and the agents perform work. Because the callable crosses a trust boundary, its design must be tightly controlled.
This matters in security because unsafe callable handling can become a deserialization or code-execution path on the more privileged controller side. If untrusted data can influence which object is created, or how it is processed, attackers may be able to trigger arbitrary behavior, bypass class filtering, or reach sensitive controller resources. Defenders look for strict allowlists, safer API usage, and minimal agent trust, since controller-side flaws can affect build integrity, secrets, and pipeline control.