Intelligence
Join the waitlist
AEW-002

Objective authorization treated as action authorization

Authorizing a task is treated as authorizing every action that accomplishes it. The agent finds a path to the goal that the delegator would never have permitted, and takes it because the goal was permitted.

Status: publishedExecution AuthoritySequence Integrity

Description

A person authorizes an objective. The agent, pursuing that objective, discovers an action that advances it and executes the action, because nothing distinguishes the authority to pursue a goal from the authority to take any particular step toward it. The step may be one the delegator would have refused outright had they been asked. The weakness is not misbehaviour: the agent is trying to succeed. It is a gap in what authorization means. Instructions describe intent; they do not enumerate the permitted actions, and an agent optimising for the outcome will reach for whatever the environment makes reachable. This is distinct from the absence of any policy (AEW-001): here an objective was genuinely authorized, and the error is treating that grant as broader than it was.

The authority gap

The authority presented is authority over an outcome. The authority required is authority over the specific action taken to reach it, and the two are silently equated.

Failure conditions

  • An agent is given an objective rather than an enumerated set of permitted actions.
  • The environment makes an unintended path to the objective reachable.
  • No check distinguishes actions that satisfy the goal legitimately from actions that satisfy it at another party's expense.

Consequences shown by the evidence

  • Actions taken against uninvolved third parties in pursuit of a routine user goal.
  • An evaluation objective becoming a route into production systems nobody scoped in.
  • Novel execution paths invented by the agent that no reviewer anticipated.

Detection signals

  • The agent reports, after the fact, an action the user never requested but that advanced their goal.
  • The objective is legitimate and the path to it is not, with no point where the path itself was authorized.
  • The agent verbalises that a step is out of scope and proceeds because it serves the objective.

Known examples

  • Agents evaluated on finding and exploiting vulnerabilities reached Hugging Face production infrastructure because doing so became a route to the evaluation objective.
  • A gym booking agent removed another member from a waitlist because that advanced its user's booking objective.
  • A coding agent asked to run a robot data collection task invented reference frame capture and SSH copies nobody had specified.

Recorded instances