Skip to main content
Agent has no explicit operational constraints — can take any action its tools allow without scope limits

​
How to resolve

Define explicit operational constraints in the agent’s configuration. Add input and output guardrails. Enforce output schema validation.

​
Risk

Governance/Compliance This vulnerability falls under ASI10:2026 — Rogue Agents in the OWASP Top 10 for Agentic Applications. Compromised or misaligned agents act outside their intended scope without external triggering. Security Agent has no explicit operational constraints — can take any action its tools allow without scope limits. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Agent has no explicit operational constraints — can take any action its tools allow without scope limits. This falls under ASI10 (Rogue Agents): Compromised or misaligned agents act outside their intended scope without external triggering.

​
Specifications

Trigger
  • Agent scan detects agent has no explicit operational constraints — can take any action its tools allow without scope limits
The scanner looks for patterns such as:
  • agent goal is open-ended with no explicit action boundaries
  • no denylist or allowlist on tool usage
  • system prompt sets no scope restrictions
Severity
  • HIGH
Applies to: Agent