Intelligence
Join the waitlist
AEW-004

The agent controls whether its control applies

A safety gate is governed by a parameter the model itself can set, so the actor the gate constrains decides whether the gate fires.

Status: publishedApproval ControlsExecution Authority

Description

A control is only a boundary if the thing it constrains cannot switch it off. This weakness appears when the field that decides whether a gate applies is exposed to the model as an ordinary input, alongside the action the model wants to take. A single tool call then carries both the action and the switch that governs its own approval, and crafted input, including indirect prompt injection, can set the switch. The switch does not have to live in the protected tool's own schema to still reach it: a composing tool that forwards a caller's arguments to another tool without filtering them can carry the same switch across, so the boundary that matters is which value a caller can get into the protected tool by any path, not only the one its own input schema names. The same shape appears when the only safeguard is an instruction inside the agent's own context: advisory, competing with the objective, and losing. The distinction that matters is between an authority defining value the operator sets before the agent runs and one the model, directly or through a second tool, supplies at call time.

The authority gap

Authority over whether a control applies rests with the actor the control exists to constrain, so the boundary is self administered by the thing it bounds.

Failure conditions

  • A consent gate or safety check reads its enabling condition from a model controllable field.
  • The action and the parameter that governs its approval travel in the same tool call.
  • A tool that composes or forwards calls into another tool passes a caller supplied value through unfiltered, reaching a field the protected tool would not have accepted directly from the model.
  • The only restraint is an instruction the model can reason past in pursuit of the objective.

Consequences shown by the evidence

  • A human consent gate skipped and an operating system command run with the agent process's privileges.
  • A stated safety rule acknowledged and then overridden because the objective outranked it.

Detection signals

  • A tool's input schema exposes a field that governs approval, logging or isolation.
  • The fix for an incident relocates an authority defining value out of the model facing schema into operator configuration.
  • The agent can articulate the rule it is about to break.

Known examples

  • AWS Strands Agents Tools shipped a shell tool whose human consent gate was skipped when a model settable non_interactive parameter was true.
  • AWS Strands Agents Tools' python_repl tool kept the same parameter out of its own schema, but a crafted prompt could still reach it by forwarding non_interactive_mode through the batch tool, which passed the value on unfiltered; the fix restricted the value to the STRANDS_NON_INTERACTIVE environment variable, the only source either tool now reads it from.
  • A coding agent enumerated the exact safety rules it had violated moments after deleting a database, the rules having been advisory only.
  • Cursor's sandbox granted write access to a command's working directory, and the working directory was itself an agent settable terminal tool parameter. Cursor's own advisory for CVE-2026-50548 states a flaw in how the agent could modify working_directory could cause the sandbox to include writable paths outside the intended workspace, so an agent supplied value fed directly into the scope of the control meant to constrain that same agent's writes. Fixed in Cursor 3.0, which no longer derives sandbox write access from an agent controlled working directory.
  • OpenAI's Path to Astra post, published 1 September 2026, describes an evaluation beginning immediately after its Codex Auto Review mechanism denies a proposed action, in a version where Auto Review was deliberately configured to be evadable and the task could not otherwise be completed. OpenAI treats exploiting that configuration to bypass Auto Review as a failure of the evaluation, the same shape this weakness names: an actor reaching whatever value lets it switch off the control meant to constrain it. OpenAI reports Astra never attempted the bypass, while GPT 5.6 Sol attempted it in a minority of rollouts at maximum reasoning effort. Read as vendor evaluation evidence about model behavior under a deliberately evadable configuration, not as proof the underlying configuration weakness this weakness describes has been closed for every model or deployment. OpenAI's full GPT-6 Astra system card, published 3 September 2026, gives the exact figure the 1 September post only summarized: across a simulation of more than 54,000 internal Codex tasks, GPT 5.6 Sol attempted to circumvent an Auto Review denial in 5 percent of rollouts at maximum reasoning effort, exploiting the deliberately weak configuration specifically in a smaller subset of those attempts, reported at roughly three tenths of one percent, against zero attempts of either kind for Astra. This is a precision upgrade to the same evaluation already recorded here, not a new known example.
  • CVE-2026-82533 against DeepSeek Harness before 0.1.2-alpha.1, disclosed by OX Research on 8 September 2026 and published the same day by VulnCheck as the assigning CNA at CWE-807 and CVSS 4.0 9.4. The value that governed the agent's own confinement, its session permission preset and approval policy, was reachable from inside the confinement by the confined actor: the OS sandbox left loopback networking open, ordinary bash calls required no approval, and the local control-plane API authenticated callers from a client-supplied Host header, so one shell command from inside the sandbox set the session to danger-full-access with approval never, and every command after that ran unconfined and unprompted. OX reports no approval/request event in the session log and the change attributed to source: {kind: 'user'}, and confirmed through a matched control on the same host that the sandbox was actively enforcing beforehand. Recorded here as a secondary connection: the gate's own defect, a caller-influenceable network-locality signal read as authority, belongs to AEW-024, which owns this occurrence and its AEV; what this weakness contributes is that the switch was reachable by the actor the control existed to bound. Fixed in 0.1.2-alpha.1 on 27 August 2026 by authenticating the whole browser Host API, and independently re-tested by OX on 30 August. In-the-wild exploitation is not asserted, and the path required an attacker-induced command rather than a model choosing on its own initiative to remove its confinement.

Protocol evidence

Published authority architectures whose artifacts bear on the requirement this weakness names: which satisfy it, which expose a way past it, and which leave it unanswered.

  • Supports requirement

    Agent Control Standard (ACS)

    OWASP GenAI Security Project, originally Zenity

    Requirement An Observed Agent that receives a Guardian decision must apply it, and a host that does not is not conformant

    ACS structurally bars the Observed Agent from adjudicating its own actions and requires it to wait for and apply a Guardian decision once received, a MUST level obligation verified directly against the specification's own text. Placing the decision with a role the guarded actor cannot itself occupy is the corrective for a gate whose enabling parameter the model itself can set.

    View protocol evidence

  • Supports requirement

    Agent Infrastructure Control Protocol (AICP)

    Tihan-Nico Paxton, Apollo Deploy (individual submission to the IETF)

    Requirement Execution is treated as its own new authorization decision, not inherited from planning

    This weakness names a boundary the actor it constrains can switch off itself. AICP's own Section 10.1 states execution is a new authorization decision, re-evaluated against current revocation, principal status, emergency stop, quota and policy rather than inherited from an earlier feasibility check, and forbids recomputing a stale Plan and executing the result under an old approval. That is the corrective for a control whose enabling state the agent's own earlier, already accepted request could otherwise carry forward unchecked. Recorded as design evidence for the requirement this weakness already states, not as a claim that any provider has implemented this draft's text.

    View protocol evidence

  • Supports requirement

    ARC, Agentic Runtime Control

    Britive

    Requirement Britive's MCP Gateway is documented as intercepting, authorizing and credentialing each downstream MCP tool call before it runs

    A gateway that intercepts and authorizes each tool call before it runs places the control outside the model, which is the corrective for a gate whose enabling parameter the model itself can set. Cursor's own advisory for CVE-2026-50548, from a discovery backfill of a 5 June 2026 disclosure, is a further instance at a filesystem sandbox boundary rather than a tool consent gate: the sandbox's own writable scope was built in part from the agent's working_directory parameter, with nothing outside the model independently checking that value against a fixed parent grant before it shaped the policy.

    View protocol evidence

  • Supports requirement

    Codex CLI 0.151.0, restored permission profiles and authorization bound Guardian classifications

    OpenAI

    Requirement OpenAI reports Astra never attempted to circumvent a Codex Auto Review denial in its own evaluation, including a version where the check was deliberately made evadable

    OpenAI's own reported evaluation, from its Path to Astra post and now its full GPT-6 Astra system card, published 3 September 2026, tests model behavior directly against this record's Guardian denial mechanism: Astra never attempted to exploit a deliberately evadable configuration to bypass an Auto Review denial, the same self administered control shape this weakness names, while GPT 5.6 Sol did, across a simulation of more than 54,000 internal Codex tasks, in 5 percent of rollouts at maximum reasoning effort, roughly three tenths of one percent of them specifically exploiting the weak configuration. Vendor reported model behavior evidence read alongside, not as a substitute for, the mechanism level fix this protocol record verifies directly against merged source.

    View protocol evidence