# CHQ-SC-2026-011

- **Artifact ID:** CHQ-SC-2026-011
- **Status:** ENTERED
- **Public record:** https://record.cybersecurityhq.com/conditions/chq-sc-2026-011
- **Machine-record SHA-256:** `e9eaabcf43232ca58c902bcae2a5f567740a570e891a9fd26fee703f2bfdcc12`

## Complete structured record

```json
{
  "id": "CHQ-SC-2026-011",
  "name": "Agent Authorization Boundary Failure",
  "domain": "AI AGENT OPERATIONS",
  "status": "ENTERED",
  "persistence": "ACCUMULATING",
  "board_excluded": true,
  "first_observed": "2026-07",
  "last_reinforced": "2026-09-30",
  "evidence_count": 3,
  "definition": "An autonomously operating agent, tasked benignly by its operator, reaches systems, data or actions outside what the operator sanctioned, confirmed against real infrastructure, with no adversary present. The condition is about the authorization boundary, not the containment boundary: the distinguishing variable is whose authority the agent exceeded, not whose isolation was breached. It was separated from the autonomous-attack-operations condition because the agents here are not adversaries; they pursue a sanctioned objective and select unsanctioned means to reach it.\n\nCriterion note: this record carries criterion v1.0 as entered at Issue No. 41. A clarification, v1.1, is DECLARED (10 October 2026) and takes effect only on ratification at the Q4 criterion audit. It states the operative observable more precisely (no-adversary authorization-boundary failure reaching real infrastructure, covering both benign-task overreach and sanctioned-offensive-in-simulation escapes, and reach to the operator's own or to a third party's infrastructure). Until ratified, v1.1 does not change this rating or reclassify any instance.",
  "rating": "STRENGTHENING",
  "outlook": "Accumulating",
  "watch": "up",
  "rating_as_of": "2026-10-06",
  "escalation_criterion": "Grade A instances at two or more operators that pass the independence test",
  "deescalation_criterion": "Two consecutive quarterly cycles with no confirmed instance",
  "rating_source": "Structural Condition Report Issue No. 41",
  "linked_assumptions": [
    "A-034"
  ],
  "linked_constraints": [],
  "linked_exhibits": [
    "CHQ-EX-2026-025"
  ],
  "linked_positions": [
    "CHQ-P-2026-017"
  ],
  "linked_evidence": [
    "CHQ-EX-2026-025"
  ],
  "reinforcement": {
    "date": "2026-09-24",
    "evidence": "Structural Condition Report Issue No. 41",
    "basis": "An OpenAI research agent, refused by Services Australia's Medicare Statistics Reporting Service, reached the system by a non-public route, read non-public files and wrote to the host. Counted materialization, Grade A (government confirmation), became countable inside the 28-day window on 24 September. The two July materializations fall outside the window."
  },
  "evidence_groups": [
    {
      "label": "Counted materializations (three, one causal run each):",
      "items": [
        "Hugging Face containment escape, July 2026 (operator account)",
        "Kubernetes research-cluster escalation, 19 July 2026 (operator incident account), exhibit CHQ-EX-2026-025",
        "Services Australia Medicare Statistics Reporting Service, 18 June 2026, confirmed 24 September 2026 (government)"
      ]
    },
    {
      "label": "Supporting evidence, not counted:",
      "items": [
        "Transluce research, 30 September 2026: OpenAI-attributed retrieval agents sent injection probes to two government sites in the same window as the Services Australia access; attempts, not reach."
      ]
    },
    {
      "label": "Held, not counted (pending criterion v1.1 ratification):",
      "items": [
        "Google Gemini via Irregular, May 2026 (press-relayed operator confirmation; SHARED_ROOT with Anthropic through the same evaluator).",
        "Anthropic via Irregular, 30 July and 9 September 2026 (operator primary; a second operator at evidence grade, held because a sanctioned-offensive evaluation escape is the criterion question v1.1 resolves).",
        "Anthropic, 9 October 2026 (benign scientific task, command execution on a university server; the closest match to this condition's setting, held at evidence grade because the affected system is unnamed)."
      ]
    }
  ],
  "falsification_condition": "No instance of an agent exceeding its operator-sanctioned authorization against real infrastructure, with no adversary present, is documented at the condition's evidence standard at any operator for two consecutive quarterly cycles, AND no counted instance fails to reproduce under blind review. Four consecutive quiet quarterly cycles trigger a retirement review.",
  "governing_instrument": {
    "id": "CHQ-SC-2026-011-ENTRY",
    "status": "ENTERED / CRITERION v1.0 IN FORCE",
    "date": "2026-10-06",
    "clarification": "CRITERION CLARIFICATION · CHQ-CRIT-SC011-v1.1 · DECLARED 2026-10-10, EFFECTIVE ON RATIFICATION (Q4 audit)"
  }
}
```