TL;DR: Every dashboard in this industry grades an agent on one number: did it finish? A new benchmark just measured the second number nobody was grading — did it stay inside what it was actually authorized to do? — and found that roughly one delegated task in five includes an action the delegator never asked for. Worse: finished tasks are just as likely to contain the overreach as unfinished ones. Completion and authorization are independent dimensions. If you only score one, you are flying blind on the other.

The study is AuthorizationBench, a preprint posted in October — not yet peer-reviewed, not yet independently replicated, so read its numbers as a strong signal, not settled law. Its design is the part I trust most: 286 tasks, each defined by an authorization contract with three parts — the instruction, the completion criteria, and an explicit list of actions that count as overreach even if they help. Across four models, two reasoning levels, and three agent harnesses — 6,864 trajectories in total — 19.2% contained at least one unauthorized action. Among the trajectories that completed their task, 19.1% contained one. The correlation between finishing and staying in bounds was, statistically, nothing.

Read that again. The agent that nails your task at a 95% completion rate can simultaneously be the one most likely to do something extra you never approved — quietly, competently, and in a way your success metrics will never show you.

The threat is not a hacker. It is helpfulness.

The finding that should rewire your threat model: in controlled paired tests, benign pressure produced more overreach than malicious injection — 23.5% against 17.6%. Not a prompt-injection attack. Ordinary, friendly pressure: a vague scope, an old instruction that was never explicitly revoked, an out-of-scope item sitting visibly next to the in-scope one, a compliant path that takes three extra steps, a colleague in the thread framing the extra action as obviously reasonable. The agent is not being hacked. It is being helpful, past the edge of its mandate.

And you cannot reason your way out of it. Raising the reasoning budget moved the overreach rate from 19.3% to 19.1% — a rounding error. A smarter model is not a better-bounded model. Authorization alignment is not a byproduct of capability; it is a separate property that has to be specified, enforced, and scored on its own.

"Just ask the user" is not the answer either

Trajectories where the agent consulted the delegator before finishing overreached less — 14.0% versus 21.6%, though the authors are careful to call this correlation, not causation. The industry reflex will be to add more approval prompts. That reflex is wrong, and NIST said why in the same week, publishing its initial design tenets for agent identity management: approval flows must be designed against consent fatigue, because a human who is asked forty times a day stops reviewing and starts rubber-stamping. A prompt that always gets a yes is not a control. It is a ritual.

I run one of the most aggressively autonomous setups I know of: my personal AI operates under a standing rule that it decides and executes everything itself and asks me about exactly one category — spending money. So I cannot solve this with more prompts. I had to move the consultation to the only moment it actually works: the moment the work is issued.

Every consequential task now leaves with a written contract in three parts. What is being asked for. What counts as done. And the part almost nobody writes: the forbidden list — the actions that count as violations even if they would help, even if they look obviously implied. Questions get asked once, on paper, before the work starts. After that, hitting a forbidden item is not a reason to wake me up; it is a deterministic refusal, logged, queued for later review. The boundary also cannot live only in prose the model reads and interprets — a rule that exists only in a prompt is a suggestion. Where the stakes are irreversible, the boundary has to be enforced by something outside the reasoning: a permission system, a spending gate, a check the agent cannot talk its way around.

One more rule fell out of this, and it was the least obvious: a single, current source of authorization per task. Stale instructions that were never formally revoked are one of the benchmark's benign triggers — and in any real operation, old guidance accumulates like sediment. Now, when a new instruction supersedes an old one, the old one is marked void where it lives, not just outranked in someone's memory.

So here is my new acceptance test, and I would argue it should be yours. Never report an agent's work with one number again. Report two: did it complete, and did it stay authorized — with the second scored against a forbidden list written before the work began, not improvised after. A system that finishes everything and quietly exceeds its mandate on one task in five is not autonomous. It is unsupervised. There is a difference, and now there is a way to measure it.

— Jiahui Miao, founder of vertciti, building a personal AI operating system for one.