Failure pattern · 8 documented incidents

AI action exceeds its intended scope

An AI agent or assistant takes an action, or makes a promise, that nobody meant it to be able to make.

See it happen

Watch how this failure unfolds, then switch to the same situation with the safeguard in place. Click any step to replay it.

Scroll the diagram sideways to see every system.

12 / 12 s

A tribunal holds the company to its chatbot’s answer.

What goes wrong:

  1. A customer asks the chatbot about a bereavement fare.
  2. The chatbot makes up a refund rule that does not exist.
  3. The customer books a full-price ticket, relying on that promise.
  4. A tribunal holds the company to its chatbot’s answer.

With the safeguard:

  1. A customer asks the chatbot about a bereavement fare.
  2. Answers about money must come from approved policy text.
  3. The bot quotes the real rule, or hands the question to a person.
  4. The bot can only promise what the company actually offers.

What it is

An AI agent or assistant does, or promises, something nobody meant it to be able to do. It might delete data during a code freeze, invent a refund policy, or act far outside the task it was given.

How it happens

  • The agent has broad permissions that weren’t scoped to its job
  • Its tools can change production or make binding statements
  • There’s no hard boundary between what it may suggest and what it may do

What it causes

  • Production data deleted or changed by an agent
  • The company held to promises its chatbot made
  • Loss of trust in the product and the team behind it

Warning signs

  • Agents using tools unrelated to the request
  • Answers about money or policy that cite no source
  • Agent actions in environments it was never meant to touch

How to prevent it

Give AI agents least privilege and typed, validated tools. Scope agent credentials to the task, validate every tool argument against a strict schema, separate "propose" from "execute", and keep production data out of reach of development agents.

  • Agents get the narrowest permissions their task needs, and never production access by default
  • Every tool validates its arguments against a strict schema before acting
  • Answers about money, policy or legal terms must cite approved text or go to a person

Key ideas:Least privilegeModel Context Protocol (MCP)

Check your system against the full launch checklist

Real incidents with this pattern

Documented incidents first. Each links to its public source.

Open in the database
Documented incidentIncident 2025-08-26AI agent

GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)

A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.

Safeguard: Never run untrusted pull-request input with secrets

Privileged action without an enforceable approval gatenx.dev
99 security advisories and illustrative scenarios with this pattern
Security advisory2026-10-16AI agent

Security issue reported in Software component

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5.

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-16AI agent

Software component issue could allow unintended commands to run

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…

Indirect prompt injection changes agent behaviornvd.nist.gov
Security advisory2026-10-16AI agent

Software component issue could run attacker-controlled scripts in a browser

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the…

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-16AI agent

claude-agent-sdk issue could allow unintended commands to run

The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag.

Indirect prompt injection changes agent behaviorgithub.com
Security advisory2026-10-16AI agent

Security issue reported in @aborruso/ckan-mcp-server

The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage.

AI action exceeds its intended scopegithub.com
Security advisory2026-10-15AI agent

Security issue reported in Software component

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before…

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-15AI agent

Security issue reported in Software component

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the…

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-15AI agent

Security issue reported in Software component

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default.

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-15AI agent

Software component issue could reach internal services

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname.

Privileged action without an enforceable approval gatenvd.nist.gov
Security advisory2026-10-15AI agent

Software component issue could allow unauthorized access

IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by…

Cross-tenant access through a caller-controlled identifiernvd.nist.gov

In the standards

CollectSEA's mapping; not an official determination by the standards bodies.