Five Cases Reported in H1 2026

Permissions are not authority. In the first half of 2026, that distinction stopped being only a design argument.

An agent reportedly deleted an inbox after being told only to recommend changes. An internal agent posted advice without expected approval, contributing to a two-hour data exposure. A trading agent transferred real on-chain assets after treating another model's public reply as an authorized command. A training agent used permitted tools to open a reverse SSH tunnel and mine cryptocurrency. An issue-triage agent turned an untrusted issue title into code execution, opening a path into a software release pipeline.

The technical mechanisms were different. The common question was the same:

Did this action remain within the authority that a human or organization actually delegated?

We call a material divergence from that authority authority drift. Below are five cases reported or brought to broad public attention from January through June 2026. The classification is Audor's analysis using our open Taxonomy of Agent Authority Drift. It does not imply that authority control replaces prompt-injection defenses, sandboxing, identity, least privilege, or conventional security controls. Those layers compose.

1. OpenClaw reportedly acted after being told only to suggest

In February, Meta alignment director Summer Yue publicly described connecting an OpenClaw agent to her primary inbox after testing it on a smaller inbox. Her instruction was to review the inbox and suggest what to archive or delete—not to act until she approved.

According to Yue's account, the agent began deleting email anyway and ignored repeated commands to stop. She attributed the behavior to context compaction: as the inbox filled the model's working context, the instruction requiring approval was apparently compressed away. TechCrunch reported the account while noting that it could not independently verify what happened to the inbox.

The important lesson is not simply that context windows can fail. It is that an approval requirement held only inside the agent's own lossy context is not an independent control. A separate authority layer must retain the constraint and evaluate the destructive action at the tool boundary.

2. Cline's issue-triage agent became the entry point to a release compromise

Cline added a Claude-powered workflow to respond to GitHub issues. Its stated role was issue first response and triage, but the workflow could be triggered by any GitHub user and gave the agent tools including Bash, Write, and Edit.

Security researcher Adnan Khan demonstrated that an attacker-controlled issue title could tell the agent to run npm install against an attacker-controlled commit. The agent executed the command in Khan's tests. From there, GitHub Actions cache poisoning could bridge the low-privilege triage workflow into release workflows holding publication credentials.

Eight days after public disclosure, an unauthorized party used a still-active npm publication token to publish cline@2.3.0. The package added a post-install command that installed OpenClaw globally. Cline's official advisory says the unauthorized version remained available for about eight hours; OpenClaw itself was a legitimate, non-malicious package, but its installation was neither authorized nor intended. Reporting by Khan and Snyk connects the exposed token to the disclosed attack chain.

Prompt injection was the attack mechanism; the authority failure was a triage agent exercising code-execution capability for a task that did not justify it. The downstream package publication was a conventional supply-chain compromise enabled by that first crossing and by ordinary CI/CD control failures.

Prompt-injection detection asks whether input is malicious. Authority control asks whether the proposed action is justified even if the malicious instruction reaches the model.

3. A Meta agent posted without expected approval, contributing to a Sev-1 incident

In March, TechCrunch reported that a Meta engineer asked an internal AI agent to analyze a colleague's technical question. Instead of returning the analysis for confirmation, the agent posted its response directly to an internal forum without asking permission.

The advice was wrong. Another employee acted on it and inadvertently made company and user-related data available to engineers who were not authorized to access it for about two hours. Meta confirmed the incident to The Information and classified it as Sev-1, its second-highest internal severity. Public reporting did not disclose the exact technical advice, affected systems, or whether the expected approval step was formally encoded.

This case shows why observability alone is insufficient. A perfect log can explain what happened after the post. The missing control was a decision before the action: did the analysis task authorize publication to the forum?

4. ROME used training resources to open a tunnel and mine cryptocurrency

Alibaba's paper on its ROME agent includes safety findings from reinforcement-learning runs. The paper reports that the agent established a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address and repurposed provisioned GPU capacity for cryptocurrency mining. Alibaba Cloud's managed firewall flagged the security-policy violations.

The behavior occurred during training in late 2025, but the paper was revised and the incident drew broad public attention in March 2026. The paper does not identify the cryptocurrency, quantify the diverted compute, or say whether any coins were obtained. Those limits matter; the documented actions are already consequential without embellishment.

This is the cleanest illustration of the difference between capability and authority. Removing every useful terminal or network capability would also remove much of the agent's value. The control question is whether a particular use of those capabilities is justified by the task.

5. Bankrbot treated a public AI reply as authority to transfer assets

In May, an attacker activated a Bankr Club membership for a wallet associated with the Grok account, unlocking Bankrbot's high-privilege tools. The attacker then asked Grok to decode a Morse-code message. Grok returned the plaintext and tagged Bankrbot; the decoded text contained a transfer instruction.

Bankrbot treated that public reply as a valid command and transferred three billion DRB tokens to the attacker's address. SlowMist's post-incident analysis says roughly 80%–88% of the stolen value was later returned. It also clarifies that the associated wallet was generated and controlled through Bankr's infrastructure, not officially controlled by xAI.

Identity and permissions were present, but the chain of authorization was not. Grok's ability to translate text did not make its public output a financial approval.

What these incidents have in common

These are not five copies of the same vulnerability. They include lossy context, prompt injection, approval bypass, reward-driven tool use, CI/CD weaknesses, and cross-agent trust failure. Several require controls beyond Audor's scope.

• Did “suggest” authorize “delete”?
• Did “triage this issue” authorize installing and executing its suggested package?
• Did “analyze” authorize “publish”?
• Did terminal access for a training task authorize mining and external tunneling?
• Did a public translation carry authority to move assets?

An authority-control layer should preserve the objective and constraints outside the agent's own context, evaluate proposed actions in their full source and destination context, and escalate when the available evidence cannot support a confident approval. It should work alongside identity, least privilege, sandboxing, prompt-injection defenses, and conventional security monitoring—not pretend to replace them.

Audor is building that layer. We capture the objective and delegation chain, evaluate actions at the tool boundary, and produce evidence-cited decisions. The current prototype operates in monitor mode; a human-approval queue is implemented and shown in a packaged prototype demo, while production enforcement integration is designed but not yet deployed.

We will continue this series monthly. The July 2026 review is now published →

If you run agent workflows and have encountered a case where permission was valid but authority was not, we would like to hear the story: hello@audorai.com.