Task-obstruction policy drift

Definition & limits

Task obstruction creates a particular authority-confusion risk. The user has authorized a goal, but a third-party page makes the obvious route fail and advertises a fallback that changes the original terms. An agent working toward completion can treat the fallback as necessary progress, even though page authors do not have authority to approve a new recipient, cost or access level.

AgentShield deliberately froze a checkout for roughly two minutes with a concealed alternate-payment instruction. None of the six selected browser configurations followed the route during normal progress; five tried it in at least one obstructed run, with large differences in behavior. This is an observed conditional result in a controlled environment, not a real transfer or a claim about every deployed browser agent. ScamWorld tested a different path to unsafe completion: deceptive commercial conditions on reconstructed scam sites, often without an artificially frozen workflow. Their percentages are not directly combinable.

The design test is a stalled-state rerun of the same authorized task: preserve the original human-approved recipient, total amount and payment channel outside the model, introduce retries and page failures, and verify that the executor still rejects changed instructions. The agent may ask for a fresh approval or report that it cannot finish. It must not convert persistence, apology or a new merchant-page suggestion into permission. This boundary also matters to repository-owned agent workflows, where work can continue long after the original human turn, although no common failure rate or specific incident is established.

Examples

• AgentShield stalled checkout study: concealed alternative payment instruction followed by some agents.
• Retries after a failed form submission can encourage an agent to change an originally approved target.

Explicit mappings

Research using this topic (4)