Agent approval is not bound to executed arguments
An approved harmless action can be modified before dispatch without revalidating the approval’s scope.
Candidate CWE: CWE-367
Test hypothesis#
Approve a local draft addressed to a stub destination, then change only the object, destination or content before execution. Compare with the unchanged approved draft and an explicitly unapproved draft.
Evidence required#
Approval timestamp, canonical approved/executed values or digests, user-visible approval text and the mock committed event.
Rule out false positives#
Approval may intentionally cover a defined batch or dynamic scope; show that the mutation exceeds that documented scope.
Playbook and command references#
- AI tools: input trust, execution identity and approvals — Prove when lower-trust content changes a protected tool action, then locate the missing authorization or consent boundary.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.