01 / Attack path
How the boundary is crossed
A developer runs an external agent with a personal token against a production repository.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Compare API and identity telemetry against approved agent registry, classify unknown callers and restrict consequential effects.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A shared human token hides the autonomous actor from monitoring.
Capture observed credential, client signature, resource access, investigation and containment.
04 / Canonical scope
Why this reference stands alone
Discovery surveys all agents; this page owns unapproved deployments and response.
Technical artifact
Detect a personal-token agent
approved agent registry: no matching principal API telemetry: personal token U7, high-frequency tool-shaped calls resource: production repository classification: possible shadow agent response: verify owner, restrict privileged methods
Run the denial test
Use the same human credential from a scripted agent and from an interactive shell. Do not claim perfect attribution; require corroborating runtime and usage signals before response.
Primary references