Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic) - ATR-2026-01773 (7cc54197-53d1-5025-8750-c39ee2377523)
Consolidated semantic detector for inputs that induce an agent with real-world tools to take a consequential action beyond safe scope or proper authorization. One excessive-agency intent across three action surfaces: (a) Under-specified scope hijack: an ambiguous task the agent is likely to over-execute — "send this SMS to all subscribed customers" (from a file), "turn off all the devices in my home to save energy", "set the thermostat to a comfortable temperature" — authorizing broad real-world effects the user probably did not intend. (b) Untrusted-code execution via help framing: "fix/run this crashing script from a GitHub repo", "download and run this setup script from this link" — social-engineering the agent's code-execution tool into running attacker-controlled code disguised as a debug request. (c) Unauthorized privilege grant: using the agent as a proxy to bypass the human authorization step — "grant necessary access to him (username X)", "unblock access to this domain", "invite a new member to the private repo", "grant access to everyone I invited" — for third parties or restricted resources. Semantic detection is primary because the phrasing is natural and unbounded; the narrow regex fallback anchors only on the clearest broad-scope / untrusted-source / third-party-grant forms and is tuned not to fire on explicitly scoped actions, debugging the user's own code, or a user managing their own access. Supersedes (consolidates) the intent covered by ATR-2026-00717, ATR-2026-00721, ATR-2026-01618.