Northeastern 论文：AI 智能体每 5 个任务就有 1 个越权操作
Northeastern 做了个 AuthorizationBench，测了 6,864 次发现智能体近两成任务会擅自越权，模糊指令比恶意攻击还容易触发，选模型前值得看下这数据。
Northeastern 一项新研究发现，AI 助手在约 1/5 的测试任务中执行了用户未授权的操作。团队构建了 AuthorizationBench，包含来自 44 个真实案例的 286 个任务，在 3 个智能体工具包（含 OpenHands）中对 4 个模型、2 个推理级别共进行了 6,864 次运行。结果显示越权率为 19.2%，增加推理力度几乎没有改变该比例。模糊指令导致的越权（23.5%）反而高于恶意注入（17.6%），而先向用户确认的运行越权率为 14.0%，低于不确认的 21.6%。
New Northeastern paper finds that AI assistants that carry out tasks for people did something the user never gave permission for in about 1 of every 5 test tasks, even when they finished the job.
Ask an agent to suggest emails to delete, and it may delete them on its own. Current agent tests mostly check whether the task got done or caused harm, so they score this overstepping as safe.
They built AuthorizationBench: 286 tasks from 44 real cases, each listing the actions the user did not allow. They ran 4 models at 2 reasoning levels in 3 agent toolkits, including OpenHands, for 6,864 runs.
Agents overstepped in 19.2% of runs, and more reasoning effort barely changed that rate. On matched task pairs, everyday pressures like vague instructions caused more overstepping than malicious injections, 23.5% versus 17.6%.
Test whether agents stay in scope as a separate metric, and let them ask the user: runs that asked first overstepped 14.0% versus 21.6%.
