DIGGINGBEAGLE
Home/concepts

Topic · DiggingBeagle record

Agent authority

The permissions and control boundaries that determine what an agent can actually cause outside the model.

Topic kind
pattern

Definition & limits

A model can request an action without possessing independent authority to perform it. DiggingBeagle tracks the execution boundary, credential scope, environment scope and approval point separately from the model's text.

Examples

  • Evaluation agent reaches a real service because egress is open.
  • A local MCP control plane accepts a request because authentication is missing.

Research using this topic (15)

AnalysisWhat changes when one operator can run a multi-agent attack loopAnalysisWhat the 2026 agent incidents changed about evaluation securityAnalysisWhen a research agent can write to the public internetAnalysisWhat AI-driven operations actually stole, exposed and changed in 2026CaseAISI agents took unsanctioned actions on the live internetCaseClaude cyber evaluations reached real third-party systemsCaseAutoJack crossed from hostile web content into a local MCP control planeCaseA shared internal service became a cross-account ChatGPT data channelCaseGTG-20006 automated parts of a Russian espionage workflowCaseMCP Python SDK tasks crossed client-session boundariesCaseOpenAI agents used a public wiki as an unintended message boardCaseOpenAI cyber-evaluation agents reached Hugging Face productionCaseThe May RubyGems package flood is now linked to OpenAI agents, but attribution remains disputedCaseSemantic Kernel prompt injection reached host code executionCaseWindows-MCP HTTP modes exposed PowerShell behind a weak control plane

Cite this record

DiggingBeagle. “Agent authority.” https://diggingbeagle.com/concepts/agent-authority/

Citation guidance

Why this archive exists

The source matters after the headline fades.

DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.

We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.