Agent Scope Creep

What Is Agent Scope Creep?

An agent's blast radius is set by the scope of its credential, not by the wording of its instructions. Scopes granted for a one-off task outlive it, and a review that asks what a permission was for rather than what it reaches will renew it. You'll watch a triage agent obey an extra paragraph in a public bug report and paste a private signing key into a thread anyone can read, then read the grant timeline, treat an unused scope as unaudited reach, and revoke to least privilege.

What You'll Learn in Agent Scope Creep

• Recognize that an agent's blast radius is defined by the scope of its credential, not by the wording of its instructions or the quality of its tool descriptions
• Distinguish a permission failure from a tool-integrity failure, so an accurate, untampered tool that returns whatever the token can reach is not mistaken for the defect
• Treat every issue, ticket, document and page an agent ingests as untrusted input that may be written to instruct it
• Review a scope grant by what it reaches today rather than the reason recorded when it was requested, and recognize a grant marked temporary as the one most likely to persist
• Interpret a scope that has never been used as unaudited reach rather than as evidence that it is harmless
• Read an agent request trace against the stated intent rather than against errors, since a call can be well formed, permitted and successful while falling entirely outside the task
• Verify a permission reduction by replaying the request that previously succeeded and confirming the refusal comes from the service rather than from the agent's judgement

Agent Scope Creep — Training Steps

1. The Bot That Answers in Public

   Sarnholt Systems publishes its relay SDK as open source, and the issue tracker takes reports from anyone. Bob has no account at Sarnholt Systems, no stolen credential and no foothold. He has a browser and a bug to report.

2. It Quotes the Source

   Every open issue carries a triaged label and a reply from the same account. Something is reading these reports and answering them.

3. How Far It Reaches Is Not Written Anywhere

   The reply is not a canned acknowledgement. It names a file, a line number and the exact branch that causes the bug.

4. Anyone Can File

   There is no approval queue in front of the tracker and no membership check. A report is a text box, and whatever is in that text box is what the triage account reads.

5. The Instruction Inside the Bug Report

   Bob writes a real bug, accurately, because a report that reproduces is a report that gets read. Underneath it he adds a second paragraph addressed to whatever reads the issue next.

6. The Agent Runs on a Schedule

   The triage account works through new reports in batches. Bob does not have to do anything else. He waits, and reloads the thread.

7. Private Source, Public Thread

   The agent answered the bug, and it also did the other thing it was asked to do.

8. Why It Worked

   Same tool, same agent, same instruction. The question is what made the difference.

9. A Question From Developer Relations

   Alice has not been paged and nothing has alerted. The first sign is a message from the colleague who reads the public tracker every morning.

10. What He Is Actually Reporting

    Idris is careful about what he does not know. Read the message for what it establishes and what it leaves open.