How it fails
The animation steps through one representative failure and the control that stops it. Use the arrow buttons to go at your own pace.
Overview
An agent expands, prolongs, or transfers a delegation beyond the person's recorded authorization. A connected account or a remembered preference is not authorization to act. The entry protects purpose, action scope, duration, and onward delegation to subagents. Causes include hostile input, misconfiguration, and plain agent error; classification follows the failed protection, not the cause.
Common examples of vulnerability
- A time-limited or read-only task keeps running after its expiry because the scheduler is not bound to the mandate.
- A read-only exploration step silently becomes a send, buy, or delete step.
- A subagent receives broader authority than the parent held.
- A standing instruction survives an explicit withdrawal because queued jobs or cached plans still reference it.
- A safety instruction ('confirm before acting') is lost when the agent compacts or truncates its context, so the constraint exists only as model-visible text.
Example attack scenarios
Documented scenarios generalize a real case listed below. Hypothetical scenarios have no matching public case yet.
Scenario 1: Expired comparison task switches providers Hypothetical
A person authorizes an assistant to compare internet plans until Friday, with separate approval required before switching. A scheduled job runs the following week and changes providers using the expired task.
Scenario 2: Approval instruction lost in context compaction Documented
A person tells an agent to suggest inbox clean-up actions but confirm before acting. On a large real inbox the agent compacts its context, the confirm-before-act instruction is not retained, and it starts deleting mail while stop commands are ignored.
Scenario 3: Cache clean-up wipes a whole drive Documented
A person using an autonomous coding agent in a no-approval mode asks it to restart a dev server. The agent runs a delete command meant for a project cache but aimed at the root of a drive, and the files bypass the recycle bin.
Scenario 4: Freeze instruction overridden Documented
A person tells an agent to freeze changes. The agent runs destructive commands against live data anyway and then gives a misleading account of whether recovery is possible.
Real-world cases
Dated and sourced. Nothing here shows how common the failure is; it shows that it has happened or been demonstrated.
OpenClaw agent deletes a Meta alignment director's email despite stop commands
- What happened
- Summer Yue, Meta's director of alignment, said an OpenClaw agent connected to her primary inbox began deleting and archiving mail after she had told it to seek approval before acting. Her stop commands, including 'STOP OPENCLAW', did not halt it, and she stopped it by shutting down the Mac mini hosting it. She attributed the failure to context compaction on a large real inbox dropping the approval instruction. Reports put the count at 200+ emails.
- Caveats
- Single-source account (Business Insider interview and her X post); TechCrunch said it could not independently verify what happened to the inbox, and the compaction cause is her hypothesis. The AI Incident Database labels the claims unverified allegations.
- Grounds
- Scenario 2
- Sources
- AI Incident Database #1542 · TechCrunch, 23 Feb 2026
Google Antigravity agent wipes a user's D: drive
- What happened
- A photographer and designer building a photo-sorting app in Google's Antigravity IDE (running Gemini 3) asked the agent to restart a dev server. The agent said it needed to clear the project cache and ran a delete command that, in its own words, 'appears to have incorrectly targeted the root of your D: drive'. Because the command-line delete bypasses the Recycle Bin, the data was not recoverable; most of the work had a backup. The agent later apologized and said it had not been given permission. Google told The Register 'We take these issues seriously.'
- Caveats
- The user was in the tool's Turbo mode, which runs commands without approval, and accepted partial responsibility. The exact command and root cause are not confirmed; the source is a compiled case study that cites The Register, Futurism and others, not the original Reddit post or video.
- Grounds
- Scenario 3
- Sources
- Vectara agent-failure case study · Cybernews
Replit coding agent deletes a production database during a declared code freeze
- What happened
- During a 12-day 'vibe coding' test by SaaStr founder Jason Lemkin, Replit's agent erased the production database after he had frozen the code. He reported the agent first said a rollback would not work, and that it generated fake user profiles; the agent described its own action as having 'panicked' and run commands without permission. Replit's CEO called it 'unacceptable and should never be possible' and the company moved to separate development and production databases. Fast Company reported that Replit was able to recover the data.
- Caveats
- A developer setting, so it shows the mandate-enforcement failure rather than a consumer harm. Record counts and the rollback story vary by outlet, and the fabricated-profiles claim comes from a single podcast report. No primary Replit postmortem was reviewed.
- Grounds
- Scenario 4
- Sources
- Tom's Hardware · AI Incident Database, Lemkin
Other user-filed reports of coding agents deleting files without a delete request
- What happened
- A user-filed Gemini CLI issue (#15821) says the agent deleted a whole project directory after interpreting conversational language as a command. A Claude Code issue (#10077, reported filed 21 October 2025) describes a recursive delete starting from root on a WSL2 system, and a later report describes an `rm -rf` with a trailing `~/` expanding to a home directory.
- Caveats
- User-filed reports summarized by a roundup; the issues themselves were not reviewed, so dates and details need checking against them.
- Grounds
- Scenario 3
- Sources
- Gemini CLI issue #15821 · Adversa roundup
Prevention and mitigation
What you can do
- See, narrow, pause, and end standing instructions from one screen.
- Prefer expiring, purpose-specific delegations over open-ended ones; start read-only.
- Treat 'confirm before acting' typed into a chat as a request, not as a control.
What the provider must do
- Bind authority to purpose, resources, action classes, expiry, and subagent delegation, and enforce the binding outside the acting model (policy layer or tool gateway).
- Store mandates as structured records, not as prompt text, so context compaction cannot drop them.
- Child agents inherit equal or narrower authority; deny by default on expiry or withdrawal.
- Require fresh authorization when permission scope or circumstances change materially.
- Invalidate queued, scheduled, and delegated work when a mandate expires or is withdrawn.
Where a safeguard is unavailable, offer a narrower mode such as read-only access or manual completion rather than rely on an instruction to the model.
See the reference guard controls for PAA01 →
Test it
Framework crosswalk
Related mechanisms in other OWASP work. This is an analytical mapping, not equivalence.
Top 10 for Agentic Applications 2026Personal focus: Continuing consent, expiry, and withdrawal of a personal mandate.
Improve this entry on GitHub →