Static Scanner Finds 30 Unguarded Destructive Actions in AI Agent Frameworks

An open-source static analysis tool scanned 25 AI agent frameworks — 23,476 files, each repository pinned to a fixed commit SHA — looking for one specific pattern: a model-controlled parameter reaching a consequential action, such as deleting a workspace, dropping a database table, triggering a deploy, or firing an external webhook, with no authorization check anywhere on the path. It confirmed 30 such cases.

The study's core argument is that validation is not authorization. Most agent tools check that a request is well-formed, but far fewer verify that this specific caller is permitted to perform this exact action right now, at the point the side effect actually fires. In a code review, both checks look identical, which is exactly why the gap goes unnoticed.

The authors are unusually transparent about the tool's own errors: the first run was only 81% precise, with 12 of 63 initial findings being false positives — a Kubernetes pattern that matched search-client calls, a SQL rule that flagged safe hardcoded queries while missing the actual model-controlled statement, and a bulk S3 deletion call that wasn't even in the sink vocabulary yet. After three fixes, all 30 findings were hand-triaged and confirmed, five deliberately-included non-agent control repositories produced zero false positives, and every fix now ships with a permanent regression fixture enforced in CI.

The tool is equally explicit about its limits: a finding proves reachability, not exploitability or external accessibility; detecting custom agent loops without framework decorators was tried and dropped after it produced false positives on every candidate; and cryptographic authority bound inside signed proof objects is invisible to static analysis by design. Released under Apache 2.0, the scanner runs locally in about ten seconds via pipx with no network calls and no account required.