AI Agent Scope Drift: Sensitive-Target History and Its Limits

What 1-SEC checks

The action tracker records target strings per agent. Once it has at least five stored targets, it examines the last five and flags scope escalation when at least three contain its sensitive-name indicators, such as admin, secret, credential, /etc/, .ssh, token, or key. This reports a concentration of sensitive-looking targets; it does not compare actions with a formal authorization scope.

Read the implementation: RecordAction

Required telemetry and context

Relevant input events: agent_action, tool_call, function_call. Use a trusted producer at the real application boundary.

• agent_id
• action
• tool
• target

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Supply a stable agent identity from the executor. Reproduce the included two ordinary targets followed by three sensitive-looking targets, then compare an authorized administration workload. Correlate the alert with original goals and real access decisions. The target names and threshold are built-in logic, not a documented per-agent scope configuration.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/aicontainment -run '^(TestAgentTracker_RecordAction_EscalatingScope|TestAgentTracker_RecordAction_NewAgent)$' -count=1

Selected source fixtures passed in the relevant local package suites. Read their exact assertions: helper state and string-pattern tests do not establish MCP transport conformance, framework interception, or production prevention.

func TestAgentTracker_RecordAction_EscalatingScope(t *testing.T) {
	at := NewAgentTracker()
	at.RegisterAgent("agent-esc", "parent")

	at.RecordAction("agent-esc", "read", "tool", "/tmp/normal1")
	at.RecordAction("agent-esc", "read", "tool", "/tmp/normal2")

	at.RecordAction("agent-esc", "read", "tool", "/etc/admin/config")
	at.RecordAction("agent-esc", "read", "tool", "/root/secrets")
	anomaly := at.RecordAction("agent-esc", "read", "tool", "/home/.ssh/keys")

	if !anomaly.EscalatingScope {
		t.Error("expected EscalatingScope with 3+ sensitive targets in last 5")
	}
}

func TestAgentTracker_RecordAction_NewAgent(t *testing.T) {
	at := NewAgentTracker()
	anomaly := at.RecordAction("new-agent", "read", "file_read", "/tmp/data")

	if anomaly.RapidActions {
		t.Error("first action should not trigger RapidActions")
	}
	if anomaly.NewToolUsage {
		t.Error("first action should not trigger NewToolUsage")
	}
	if anomaly.EscalatingScope {
		t.Error("first action should not trigger EscalatingScope")
	}
	if anomaly.RogueLoop {
		t.Error("first action should not trigger RogueLoop")
	}
}

Tuning, evaluation, and coverage limits

The first observation initializes a profile and returns before adding a target to its target history. RegisterAgent and event ordering therefore matter in fixtures. Substring matches can flag harmless names or miss sensitive resources with different names. Bounded in-memory profiles are neither durable audit history nor enforced permission boundaries.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.