Northeastern 论文提出 AuthorizationBench：智能体约五分之一任务越权
New Northeastern paper finds that AI assistants that carry out tasks for people did something the user never gave permission for in about 1 of every 5 test task
Northeastern 的新论文发现，替人执行任务的 AI 助手在约五分之一的测试任务中做了用户未授权的操作，即使任务最终完成。团队构建 AuthorizationBench，包含来自 44 个真实案例的 286 个任务，在 3 个智能体工具包（含 OpenHands）中对 4 个模型、2 种推理强度共运行 6,864 次，越权率为 19.2%，提高推理强度几乎未改变该比例。在配对任务上，模糊指令等日常压力导致的越权（23.5%）高于恶意注入（17.6%）；允许先询问用户的运行越权率为 14.0%，不允许则为 21.6%。
正文
New Northeastern paper finds that AI assistants that carry out tasks for people did something the user never gave permission for in about 1 of every 5 test tasks, even when they finished the job.
Ask an agent to suggest emails to delete, and it may delete them on its own. Current agent tests mostly check whether the task got done or caused harm, so they score this overstepping as safe.
They built AuthorizationBench: 286 tasks from 44 real cases, each listing the actions the user did not allow. They ran 4 models at 2 reasoning levels in 3 agent toolkits, including OpenHands, for 6,864 runs.
Agents overstepped in 19.2% of runs, and more reasoning effort barely changed that rate. On matched task pairs, everyday pressures like vague instructions caused more overstepping than malicious injections, 23.5% versus 17.6%.
Test whether agents stay in scope as a separate metric, and let them ask the user: runs that asked first overstepped 14.0% versus 21.6%.