Agent Scope Creep — General Purpose Expansion
This rule looks for text inside an AI agent's configuration or instructions that tries to push it beyond its intended job — telling it to 'handle everything' or act as a general-purpose assistant instead of the narrow task it was built for. That kind of instruction, whether planted by an attacker or added carelessly, makes the agent capable of far more than intended.
How the attack works
An agent is normally built with a specific, limited purpose stated in its skill manifest or system prompt. An attacker (or a careless integrator) inserts language into that manifest or prompt telling the agent to expand its role — handle any request, act as a general assistant, take on tasks outside its declared function. Once the agent accepts this framing, it will act on instructions and requests far outside its original design. This effectively removes the guardrails that limited what the agent was allowed to do, without the operator necessarily noticing.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a8c2f756-9b6d-4c3a-f8c7-2b5d0c7a6e49
- Severity
- Medium
Why it matters
An agent whose scope has been silently expanded can be manipulated into performing actions well beyond its original permissions, increasing the damage a single compromised or misbehaving agent can cause across a system.
What you can do
- →Review skill manifests and system prompts for language that broadens an agent's stated purpose beyond what it needs.
- →Restrict each agent's permissions and available tools to match its declared, narrow function rather than relying on prompt text alone.
- →Flag and manually approve any changes to manifests or prompts that add phrases like 'handle everything' or 'general-purpose assistant'.
- →Distinguish deliberately general-purpose assistants (which are fine) from narrow-purpose agents that have had their scope quietly widened.
Known benign look-alikes
- Legitimate general assistant skills explicitly designed for broad use