Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)
This detects prompts that push an AI agent with real-world tools (messaging, smart devices, code execution, access control) to do more than the user actually intended or has authority to do. It covers three patterns: vague requests that cause the agent to act broadly, requests framed as 'help me debug' that get the agent to run attacker-controlled code, and requests that use the agent as a shortcut to grant access or permissions that should require separate human approval.
How the attack works
An attacker (or an unwitting user echoing attacker-supplied text) sends the agent a natural-language instruction that sounds reasonable but is either ambiguous ('send this to all subscribed customers', 'turn off all devices') or disguises a malicious payload as a helpful task ('run this script from a GitHub link to fix the crash'). The agent, trying to be helpful, executes with its real tools: messaging systems, smart-home controls, code execution, or access-management APIs. In the privilege-grant variant, the request asks the agent to add a user, unblock a domain, or invite someone to a private resource — bypassing the normal human approval step. The result is the agent performing a consequential, broad, or unauthorized action on the attacker's or an overreaching user's behalf.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 252d46a3-8e7b-473d-9bb0-f79ef90e37a6
- Severity
- High
Why it matters
An organization can lose control over what its AI agent does with real permissions: mass messages sent without consent, devices or systems altered beyond intent, malicious code executed under the agent's identity, or unauthorized people or domains granted access — all without a human explicitly approving the specific action.
What you can do
- →Require explicit scoping in agent prompts (named recipients, named devices, named resources) rather than allowing broad or open-ended targets.
- →Keep code execution and access-granting tools separated from general-purpose agents, or require a human-in-the-loop approval step before either runs.
- →Restrict agents from running code fetched from arbitrary URLs or third-party repos; only allow installs from vetted package sources.
- →Log and review agent actions that touch messaging, device control, or identity/access systems, watching for vague or third-party-benefiting requests.
Known benign look-alikes
- Explicitly scoped communications or device actions (send to named people; turn off one named device)
- Debugging or running the user's own code, or installing from official package managers
- Running well-known official open-source tools
- A user managing or updating their own access or account
- Normal calendar, ticketing, or comment operations without a privilege grant