This has the potential to get very complex very quickly. But, off the top of my head:
Making a USB device do something nasty, depending on what qube it is passed into
Persistent Firmware
Taking advantage of anything that is shared amongst all qubes
Shared Resources
…but I promise you, there are definitely more.
True, all code requires facilitation (input), but that facilitation doesn’t necessarily need to come from a person.
For example, in Windows, if a drive contains a file called autorun.inf in it, Windows will blindly do whatever is contained in that file as soon as you insert the drive.
You’ve most likely encountered this if you ever inserted a CD-ROM into a Windows machine, and a launcher for the software showed up on the screen
It was intended as a convenience feature, but it has huge potential to be abused for malicious intent.
