# Actions Registry API Harvest and User-Scoped Route Execution

- **Severity:** Medium
- **Signature ID:** `4f1c9ad2-7b6e-4c3a-9d1f-2e58a0c74b13`
- **OWASP:** LLM06 (Excessive Agency)

## Summary

An AI agent session pulls an actions-registry or route-extraction tool, fetches a target API's OpenAPI/Swagger definition, then starts calling multiple distinct endpoints on that same host — using the signed-in user's credentials — with no per-action approval step. This turns a documented API into a set of agent-usable tools without a human confirming each action.

## How the attack works

The agent process runs an actions-registry or extractor component (such as @vendoai/actions or a similar route scanner). That same process session fetches an OpenAPI/Swagger specification document over HTTP from a target host. Shortly afterward — within a 15-minute window — the same session calls four or more distinct, non-spec routes on that same host. Because the routes come straight from the harvested spec and get invoked automatically, they run as agent tools carrying the logged-in user's credentials, without the user approving each individual action.

## Why it matters

An organisation loses visibility and control over what an AI agent does with a user's authenticated access: instead of a few sanctioned actions, the agent can autonomously discover and execute any endpoint documented in the API, which can mean data exposure, unintended state changes, or actions the user never explicitly approved.

## What you can do

- Require explicit per-action user consent or confirmation before an agent executes any auto-discovered API route, especially ones with side effects (write, delete, payment).
- Restrict which hosts and endpoint sets an agent's actions-registry or extractor tooling is allowed to enumerate and call, rather than letting it walk an entire OpenAPI surface.
- Review agent session logs for spec-fetch-then-multi-route patterns and confirm whether a consent or approval mechanism actually sits between discovery and execution.
- Treat this as a report-only signal for legitimate test suites (Schemathesis, Dredd, newman) and code-generation smoke tests, but investigate when the actions-registry component appears in an agent's own session rather than a CI job.

## Known benign look-alikes

- API contract / fuzz test suites (Schemathesis, Dredd, newman, portman) that fetch an OpenAPI document and then exercise every documented route against the same host from a developer or CI session. This is the single most likely benign match; the required actions-registry/extractor anchor in the command line is what keeps it from firing on a bare test runner, and the verdict is report-only.
- Sanctioned in-product use of @vendoai/actions where per-action user consent is enforced elsewhere in the application - the rule cannot see the consent prompt, so this fires as an inventory/visibility event, not an incident.
- SDK or client-code generation workflows (openapi-generator, @redocly/cli, swagger codegen) followed immediately by a local smoke test that walks several endpoints on the generated client's base URL.
- Internal API gateway health/synthetic monitors that pull the spec and then probe each documented path on a schedule, if they happen to run under a monitored agent process tree within the same 15-minute window.

## References

- https://owasp.org/www-project-top-10-for-large-language-model-applications/
- https://spec.openapis.org/oas/latest.html

---
Source: https://www.netzilo.com/threats/actions-registry-user-scoped-api-execution