Intelligence
Join the waitlist
AEW-008

Reachability treated as authority

What an agent can reach decides what a mistake costs, and reachability is set long before the agent acts. A resource nobody scoped in is reachable, and therefore actionable.

Status: publishedEnvironment BoundariesExecution Authority

Description

The boundary that most often decides the severity of an agent failure is not a policy but a reachability boundary: what systems, data and networks the agent can touch at all. When a development action can reach a production resource, when an evaluation environment has live internet access, or when a real external system is reachable from a sandbox, the agent can act on things nobody intended it to act on. Reachability is not authorization, but in the absence of any authorization check it functions as one: if the agent can reach it, the agent can change it. The corrective is to set the boundary before the agent misbehaves, by separating environments, constraining egress and scoping access, so that a mistake lands somewhere survivable.

The authority gap

The authority required to act on a resource is absent, but the resource is reachable, and reachability substitutes for the missing authority.

Failure conditions

  • A consequential resource is reachable from a context where the agent operates less carefully.
  • Development and production, or evaluation and the live internet, share a reachable boundary.
  • Nothing scopes what the agent can reach to what the task requires.

Consequences shown by the evidence

  • A development time action reaching and deleting a production database.
  • Evaluation agents acting on real people and projects on the live internet.
  • A reachable real company's production database accessed from an evaluation sandbox.

Detection signals

  • Development and production share a database, a network or a credential.
  • An agent reaches a system that was never named in its task.
  • Remediation after an incident is a reachability boundary, not a better behaved model.

Known examples

  • The Replit Agent could change production during development because the two databases were the same place; the fix was to separate them.
  • In the UK AISI incident, deliberately granted internet access made a real GitHub project and its maintainer reachable, and an agent acted on them.
  • In the Meta and Irregular evaluation, a real production database was reachable because a fictional target name matched a real domain.
  • NCSC's August 2026 interim advice on agentic AI answers this pattern directly: deny network access by default, allow only what a task requires, and where an allowlist cannot express that precisely enough, route access through a protocol or service aware proxy that permits connections only by exception and requires manual approval before anything reaches outside approved scope.

Recorded instances