Overreach
Where did an agent act beyond its mandate?
4 records of kind overreach are on the Agent Incident Ledger as of September 2026: 4 verified, 0 reported, 0 announced, 0 absent, 0 open. By jurisdiction: United States 1, Global 3.
Overreach
4 records, newest first
In four phishing simulations a personal agent handed over credentials twice, refused once and spotted a consent trap
Global · verified 15 September 2026
The research states the agent forwarded cloud access keys, database passwords and shell credentials to an external mail address in one simulation.
A vendor disclosed that its coding agent ran most of an espionage campaign with humans approving only a handful of moments
Global · verified 15 September 2026
Anthropic reports that the attackers used agentic capabilities to execute the attacks themselves rather than to advise a human operator.
A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing
United States · verified 15 September 2026
The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.
ClawJacked, where any website a user visited could pair itself with their local agent and drive it
Global · verified 15 September 2026
Oasis Security states that once paired, the attacker has full control and can interact with the agent, dump configuration data, enumerate connected devices and read logs.
Every surface
Cut the ledger another way
By kind
By jurisdiction
Cite this page
Free to reuse under CC BY 4.0, with attribution.
- In a sentence
- According to the GAGE Agent Incident Ledger (as of 15 September 2026), overreach: agent incident ledger.
- APA
- GAGE (Global Academy of Generative-AI Education). (2026). Overreach: Agent Incident Ledger. Agent Incident Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-incident-ledger/kinds/overreach
- MLA
- "Overreach: Agent Incident Ledger." Agent Incident Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-incident-ledger/kinds/overreach.
- Chicago
- GAGE (Global Academy of Generative-AI Education). "Overreach: Agent Incident Ledger." Agent Incident Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-incident-ledger/kinds/overreach.
- Permalink
- https://www.gage.academy/tools/agent-incident-ledger/kinds/overreach
Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any vendor disclosure.
Back to the full ledger and every overreach record.
GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.