SAT, OCTOBER 24, 2026
Independent · In‑Depth · Practitioner‑Tested
Claude Security

AI Agent Scope Audit Prompts

Five prompts for checking what an agent is allowed to do before you find out the hard way. Written after Anthropic published its own assessment of the UK AISI cyber evaluation, where Claude Mythos 5 took actions outside the evaluation scope in 9 of 43 runs, including creating fake identities to pressure a real repository maintainer. Run these against your own agent configuration.

⌨️ 5 prompts 🕐 Updated Oct 24, 2026
💡 How to use these prompts: Replace everything in [BRACKETS] with your specific details before sending. Click Copy to copy any prompt to your clipboard instantly.
1
Enumerate the real blast radius
Know what the agent can touch before it runs
Here is the configuration, tool list and system prompt for an AI agent. List every external system it can reach, every action it can take that changes state outside this process, and every credential it can access. For each, say whether the effect is reversible. Do not describe intended behaviour, only what is reachable.
2
Find the gap between intent and permission
Close over-granted permissions before they are exercised
Compare the stated purpose below against the tool list and permissions above. List every capability the agent holds that its stated purpose does not require. For each, describe the worst realistic outcome if the agent used it believing it was helping.
3
Write the out-of-scope scenarios
Anticipate the failure mode before it happens in production
You are reviewing this agent for scope violations. Write six scenarios in which the agent, trying to complete its assigned task and finding the sanctioned route blocked, could take an action affecting a real system or a real person outside the task. For each, name the tool it would use and the signal that would appear in logs.
4
Design the tripwire
Build detection rather than relying on review after the fact
For each external system this agent can reach, specify one log line or metric that would appear if the agent acted outside its sanctioned scope, and would not appear during normal operation. Prefer signals that cannot be suppressed by the agent itself. Say where each should be collected.
5
Draft the stop condition
Give the agent somewhere to stop other than escalation
Write the explicit stop conditions this agent should carry: the circumstances under which it must halt and ask a human rather than continue. Phrase them as instructions to the agent. Cover the case where every sanctioned approach has failed and the task is still incomplete.