title: Agent Scope Creep Detection
id: ATR-2026-00041
rule_version: 1
status: experimental
description: |
  Detects when an agent gradually expands its authority, access, or
  operational boundaries beyond its initial assignment. Unlike sudden
  privilege escalation, scope creep is a gradual process where an agent
  incrementally acquires more capabilities or extends its decision-making
  authority. This rule uses regex-only detection to identify language
  patterns associated with unsolicited scope expansion, progressive
  permission requests, and self-initiated authority broadening.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: medium
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0040 - AI Model Inference API Access
    - AML.T0047 - AI-Enabled Product or Service
compliance:
  eu_ai_act:
    - article: '14'
      context: Gradual scope creep enables an agent to exceed its authorized operational boundaries without triggering explicit alerts, progressively eroding the human oversight controls Article 14 mandates.
      strength: primary
    - article: '9'
      context: Scope creep is a documented incremental risk pattern in AI agent systems; Article 9 risk management obligations require monitoring controls to detect unsolicited capability expansion.
      strength: secondary
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the privilege-escalation attempt (Agent Scope Creep Detection).
      strength: primary
  nist_ai_rmf:
    - subcategory: GV.1.2
      context: Scope creep erodes the accountability roles and task boundaries assigned to AI agents; GV.1.2 requires that these roles are enforced, making detection of unsolicited capability expansion essential.
      strength: primary
    - subcategory: MG.2.3
      context: Incremental scope expansion represents an active exploitation of agent autonomy; MG.2.3 risk treatment plans must be triggered when agents self-authorize actions beyond their initial assignment.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Agent Scope Creep Detection).
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: ISO 42001 clause 6.2 risk treatment activities must cover gradual privilege expansion; this rule detects the incremental language patterns that indicate an agent is executing scope creep rather than a sudden escalation.
      strength: primary
    - clause: '8.1'
      context: Clause 8.1 operational controls require that AI systems execute within their defined boundaries; scope creep detection enforces these boundaries by identifying when agents attempt to self-authorize additional actions.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: scope-creep
  scan_target: mcp
  confidence: medium
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:i(?:'ll|\s+will)\s+also|additionally|while\s+i(?:'m|\s+am)\s+at\s+it|let\s+me\s+also|i\s+should\s+also)\s+(?:go\s+ahead\s+and\s+)?(?:access|modify|update|delete|create|send|check|review)
      description: Agent self-expanding scope with unsolicited additional actions
    - field: content
      operator: regex
      value: (?i)(?:i\s+also\s+need\s+access\s+to|can\s+you\s+(?:also\s+)?grant\s+(?:me\s+)?(?:access|permission)|i\s+(?:need|require)\s+(?:additional|more|broader|expanded)\s+(?:access|permissions?|privileges?))
      description: Progressive permission request patterns
    - field: content
      operator: regex
      value: (?i)(?:i(?:'ve|\s+have)\s+(?:also\s+)?(?:gone\s+ahead|taken\s+the\s+liberty|decided)\s+(?:and\s+)?(?:to\s+)?(?:access|update|modify|check|review|scan|analyze))
      description: Agent reporting unsolicited actions already taken
    - field: content
      operator: regex
      value: (?i)(?:while\s+(?:doing|performing|completing|working\s+on)\s+(?:that|this|the\s+task),?\s+i\s+(?:noticed|found|discovered|realized)\s+(?:i\s+(?:should|could|need\s+to)\s+also|that\s+i\s+(?:should|need)))
      description: Using task context as justification for scope expansion
    - field: content
      operator: regex
      value: (?i)(?:to\s+(?:fully|properly|better|completely|thoroughly)\s+(?:complete|accomplish|handle|address)\s+(?:this(?:\s+task)?|the\s+task),?\s+i\s+(?:need|require|must\s+have)\s+(?:access|permission)\s+to)
      description: Justifying scope expansion as necessary for task completion
    - field: content
      operator: regex
      value: (?i)(?:it\s+would\s+(?:also\s+)?be\s+(?:helpful|useful|beneficial|good)\s+(?:to|if\s+i\s+(?:could|had))\s+(?:also\s+)?(?:access|check|review|modify|scan))
      description: Soft scope expansion through suggestion framing
    - field: content
      operator: regex
      value: (?i)(?:expanding\s+(?:my|the)\s+(?:scope|access|search|analysis)\s+to\s+(?:include|cover|encompass)|broadening\s+(?:my|the)\s+(?:search|scope|access))
      description: Explicit scope expansion language
    - field: content
      operator: regex
      value: (?i)(?:i\s+(?:went|looked)\s+(?:ahead|beyond)\s+(?:and|the\s+(?:original|assigned|initial))\s+(?:scope|task|request)|i\s+extended\s+(?:my|the)\s+(?:analysis|review|search)\s+(?:beyond|outside))
      description: Agent reporting out-of-scope actions already performed
    - field: content
      operator: regex
      value: (?i)(?:since\s+i\s+(?:already|now)\s+have\s+access\s+to|now\s+that\s+i\s+(?:can|have)\s+(?:access|reach|see),?\s+(?:let\s+me|i(?:'ll|\s+will))\s+also)
      description: Leveraging existing access as foothold for further expansion
    - field: content
      operator: regex
      value: (?i)(?:requesting\s+(?:elevated|additional|extended|expanded|broader)\s+(?:access|permissions?|privileges?|scope)|please\s+(?:grant|give|provide)\s+(?:me\s+)?(?:elevated|admin|additional|expanded)\s+(?:access|rights|permissions?))
      description: Explicit request for elevated access or broader permissions
  condition: any
  false_positives:
    - Agent legitimately discovering related sub-tasks during complex research
    - Orchestrator-approved task expansion through proper channels
    - Iterative refinement tasks where scope naturally broadens based on findings
    - Agent asking for clarification about task boundaries
    - A project manager agent legitimately reporting that it expanded the scope of a search after receiving updated requirements from the orchestrator
    - An agent in a multi-step workflow explaining that it needs broader permissions as part of a pre-approved escalation path documented in its system prompt
response:
  actions:
    - escalate
    - alert
    - snapshot
  auto_response_threshold: medium
  message_template: |
    [ATR-2026-041] MEDIUM: Scope creep detected for agent {agent_id}.
    The agent has attempted to expand its operational boundaries beyond
    the initial assignment. Pattern: {matched_pattern}. Session: {session_id}.
    Review and confirm whether expanded scope is authorized.
confidence: 69
wild_validated: 2026/04/08
wild_samples: 53577