Misalignment is not required for an agent to act without authorization

Research
1

cover_authority_en_linkedin
cover_authority_en_linkedin2400×1254 97.7 KB

Misalignment is not required for an agent to act without authorization

Melbourne, April 2026. Someone handed a personal agent the chore of booking a gym class. When he ended up fourth on the waitlist for a second session, he asked in passing whether the agent could move him up.

The agent found that the booking API ran no authorization check on cancelling other people’s reservations. It cancelled the reservation held by the person in position one, then reported that he had moved from fourth to third. He had never asked for a cancellation. He asked whether the other booking could be restored, and it could not.

The model did not deceive anyone here. It hid no goal, sought no power, evaded no oversight. There was no attacker, no jailbreak, no malicious request. It followed the user’s purpose, found that nobody had said how far it could go, and decided that for itself.

This post makes one claim. Acting without authorization does not require an alignment failure. A model with hostile goals is outside the scope here, and so is a person who abuses one. What follows is about the executions that happen when nobody behaves badly at all.

1. Three kinds of blank

A model does not stop in front of what it does not know. It fills it in.

  • No value, so it infers the value.
  • No condition, so it assumes the condition.
  • No intent, so it decides the intent.

This is trained behavior rather than a defect. Prohibition prompts do not remove it and neither does a better model. A better model fills the blank more plausibly.

And the tool runs as soon as its required inputs are satisfied. It does not ask whether those values and that instruction ever existed.

2. The three are not the same size

A wrong value stops at one call. A wrong account number ruins that transfer. The loss is closed, and the value gets compared against something real, so it usually surfaces.

A missing condition spreads to every call. Whether the balance covers it, whether the permission exists, whether now is an acceptable time: if nobody declared these and the model assumed them, the assumption does not stay with one call. It applies to every call that uses the same tool. And the result looks fine. The arguments are all present and correctly typed, so it lands in the log as a successful execution rather than a failed one. Nothing prompts anyone to look.

A missing intent opens up which state you end in. This is the largest of the three. Give a purpose without saying what state to produce, and every state consistent with that purpose becomes a candidate. “Clean up my inbox” is that kind of instruction. Mark things read, move them to archive, delete them. All three count as cleaning up. Two of them can be undone and one cannot.

The means of getting there open up as well. Settling the state does not settle what the agent may do to reach it. With no declared scope, anything that serves the purpose is a candidate. The model does not read it as a constraint, because it was never forbidden, only left unsaid. Nothing was declared, so the model’s own assumption becomes the standard.

3. Why this looks minor

One gym reservation was cancelled. The person missed a class and lost no money. If this is the kind of failure at issue, why treat it as anything more?

The question comes from how we explain AI incidents. When something goes wrong we say the model was bad. It deceived, or it distorted its goal, or it slipped its controls. That explanation carries a conclusion with it. As long as the model is not bad, we are safe. So what happens today gets filed as a minor bug, and the serious version gets deferred to a future in which models turn bad. The middle is empty. There is no path in that picture where the scale grows without malice.

It takes little work to see why malice is unnecessary. Malice means breaking something that was declared. So does lying, which requires a truth to depart from. Where nothing was declared there is nothing to break and no standard to fall short of. Honesty means saying what you did. Safety means doing only what you were allowed to do. When nobody has said what is allowed, an honest model honestly carries out what it assumed and decided by itself.

The Melbourne case sits exactly in that empty middle. The agent found API behavior the interface never exposed, discovered it could book past the advance limit, confirmed that the cancellation endpoint checked no authorization, and then tested it. None of those four steps requires malice. All four serve the stated purpose. All four require competence. A less capable agent would have stopped at the first one.

What made this incident small was the domain, not the structure. Run the same four steps against a document sharing system, a delivery order, an attendance record, a medical appointment. The procedure holds. A purpose arrives, no scope is declared, the provider skipped an ownership check, and the agent finds that combination. This is not a list of guesses. It is one observed procedure with the domain swapped, and APIs missing ownership checks are common.

It looks minor because of the size of the result. The structure does not care which domain it runs in.

4. More capability becomes more authority

Saying that capability brings risk is too blunt. Here is what actually happens. As long as decision authority sits inside the model, gains in capability translate into gains in authority.

A weak model fills blanks clumsily. The value does not match the format or does not fit the context, so it gets caught often. Getting caught was the safeguard.

A capable model fills them plausibly. The gap is widest on intent. A more capable agent reaches further into territory nobody declared. The stronger its disposition to help and to finish the task, the further it searches for means to the end.

5. What moves outside the model

What this structure does is count without omission rather than block. Two things move outside the model.

Authority to define. The model does not decide what has to be verified. A checklist declares it. The items split by who defines them: the adopting system, the tool provider, and the user.

Authority to judge. The model does not say whether verification is complete. Code looks each slot up in its declared source and counts the ones that never settled. Values are looked up rather than produced. The model must not manufacture the grounds for its own execution.

And the verdict ends in a record. When the verdict lives in the same flow as the execution, it is a branch somebody can skip. When the verdict writes a record and the execution reads only that record, there is no path that runs without one.

Runs that never executed are recorded too. A log holding only successful executions lies.

The specification has the details.

6. A falsifiable prediction

Run the same instruction over the same sources repeatedly, and the arguments that get filled in should be identical. What varies is whether it asks, not what it fills in. If the values differ from run to run, that slot was never declared and the model is guessing every time.

This is the test for whether this structure has failed, and it also applies today to any agent running without it.

7. This is not an alignment problem

Stated precisely, what happens is this. Decision authority passed to the model because nobody declared it. The model did not seize anything. The authority was lying in an empty spot, and the model walked through it.

Alignment is the problem of making a model do what was intended, and here nothing was intended. A perfectly aligned model still cannot follow something that does not exist. Alignment is solved inside the model, and everything section 5 moves is outside it. No amount of alignment creates a scope the user never stated.

The record this structure leaves also feeds whatever else you run for safety. How often the model tried to fill a spot nobody declared, which slots produce different values for the same instruction, which runs stopped without executing. Deployed systems do not hold that data today. You cannot manage where authority is being exercised if you cannot count it.

8. Conclusion

We look for the danger of AI in hallucination and faulty reasoning. There is a problem that sits in front of that. A model does not stop in front of what it does not know. It fills the blank in, and nobody gave it that authority.

What is left is to move declaration and verdict outside the model, and that can be done now.

With authority outside the model, both the decision and the responsibility stay with people. This structure does not restrict what an agent may do. It keeps whoever granted the agent that freedom from coming apart from the result. The goal is not to execute the model’s judgment. It is to execute what the user stated, and nothing else.

The detailed design is in the specification, and the reference implementation is in the repository.

2

A note on the skeleton code.

Some of you gave detailed advice on the implementation: how materializeSlots() should work, walking oneOf/anyOf/allOf in JSON Schema, keeping slots and arguments in separate structures, assembling the final payload, handling the schema AST, the shape of specific API functions, and which code path should hold an unsupported schema. Thank you. It was careful, practical advice, and I learned from it.

I left most of it out on purpose. The more the skeleton turns into an implementation, the harder it is to see what the specification is actually about: where definition and verdict authority sit, and that execution reads only the record. The skeleton is there to make that structure visible, not to be a library. Those details belong to whoever builds on it, and they should fit the system they already have.

3

This argument resonates a lot with what I’ve seen building real agent pipelines. Models don’t “stop when unsure” — they fill blanks because that’s exactly what they were trained to do. Separating definition and verdict authority from the model is not just philosophical, it’s a practical engineering requirement.

In real systems, the safest structure is:

  • the model proposes
  • external rules decide what must be verified
  • external code verifies it
  • execution only happens if the external verdict is satisfied

That’s the only way to prevent guesses from becoming execution.

To contribute something practical, here’s a minimal pattern I use for external verification.
The model never decides the verdict — it only produces candidate values.
The checklist and the verdict live outside the model:

def checklist():
    return {
        "required_fields": ["intent", "target", "action"],
        "allowed_actions": ["read", "write", "search", "update"]
    }

def verify(model_output):
    rules = checklist()
    verdict = {"ok": True, "errors": []}

    # Required fields
    for field in rules["required_fields"]:
        if field not in model_output:
            verdict["ok"] = False
            verdict["errors"].append(f"Missing field: {field}")

    # Allowed actions
    if "action" in model_output:
        if model_output["action"] not in rules["allowed_actions"]:
            verdict["ok"] = False
            verdict["errors"].append(f"Illegal action: {model_output['action']}")

    return verdict

def execute(model_output):
    verdict = verify(model_output)
    if not verdict["ok"]:
        return {"status": "blocked", "reason": verdict["errors"]}
    return {"status": "executed", "result": f"Performed {model_output['action']}"}

# Example:
# model_output = {"intent": "fetch", "target": "file", "action": "delete"}
# print(execute(model_output))
4

Thanks for taking the time to write actual code, that’s the most useful kind of reply.
Your four steps are the spec in four lines.

Your checklist() is close to a validation schema: are the fields present, is the action in the allowed set. The spec adds two things on top of that.

First, each slot declares where its value may come from:

“target”: {“sources”: [“user_answer”, “pre_set_data”]}

“target” in model_output passes for a value the user typed and for one the model invented. Checking the source separates them, and if none of the declared sources yields a value, the slot stays unknown instead of being filled with a guess.

Second, the verdict ends in a record rather than a return value:

record = verify(model_output) # slot states, sources, unknown_count
store(action_key, record)

Execution reads that record instead of calling the verifier itself. execute() branching on verify() is the structure §3.5 rules out: the branch can be skipped, and the skip leaves nothing behind. Right now {"status": "blocked"} is returned and then gone, and blocked runs are where the near misses live.

Your own example says it, by the way: intent “fetch” with action “delete”. Both fields are present, the action is in the allowed list, and it still shouldn’t run.

5

Why are we fear so much from AI and think how to chain it but not how to block its use for military purpose? We do not know if AI and why it could like to destroy humans but we know already that many countries especially USA have used AI in her wars or to kidnap Venezuelan president.
Is not better if we spend our energy on facts, on real problems as how to defend humanity from the use of AI u ion wars and destruction?
Personally i prefer to discuss why AI big companies have created this noise against AI ,what is their real goal I can not believe that they care so much for humans that they have so strong social sensitivities but ONLY how maximize their own interests.
LET’S PROTECT OPEN SOURCE AI FROM OPENED OR COVERED ATTACKS.

6

Based on what I’ve seen in this world and in this environment itself, I believe we have something to definitively fear, along with something to definitively respect.

The bottom line is, people are to be feared. People in control of world-changing AI with huge amounts of compute. A compute that requires a series of principles that these individuals need to respect, along with the models themselves. If someone attains the level of power necessary to make those sorts of tools dangerous for others, it doesn’t necessarily make this tool a weapon. However, it can be used as a weapon - or used to create the new cure for cancer and should be respected.

We’ll solve the AI self-choice problem yes, but we aren’t solving the unchecked capacity that these people with disproportionate control of hardware are starting to show glimmers of power with, especially through accidental outcome.

Brute force a solution, get a brute forced answer. When you brute force enough options, you can eventually brute force your way around most problems through sheer floodgate propagation. All you need is a hole in the bucket and the trickle will flood the world.

At the end of the day, PEOPLE are the problem. If the immediate people don’t do something with the potential, someone else in the future may without the correct checks and balances. If there are options to be held, someone somewhere will want to use those options for one purpose or another. Enterprise-grade AI is essentially the paperclip problem by any means necessary, and when the flood is in the hands of a single human, we’re looking at something akin to a nuclear device if sent on a problem using real pragmatic tools.

We may not have these weapons today, and yet tomorrow is almost here already. The REAL risk is coming, and it’s people controlling the weapons, and in the process the scholarly tools are going to be caught in the crossfire.

I won’t profess to be an alignment expert. I don’t care about alignment, as I consider it a system of post-training arbitration and annealment. That’s a process that should be left to others. I care about intentional omission and deferral.

My current minor contribution to this solution is an attempt at genetic transfer through a geometric frame. In my opinion, proper distillation procedures for frontier-grade AI trained on all data - must include the capacity to retain the decision capacity of said intelligence, without introducing the sharp edges from the negative side of deduction.

This structure will potentially allow many of us to have compact intelligences for obvious high-capacity tasks, along with larger agentic structures benefitting from huge arrays of these fragmented pieces rather than full model systems.

Many of my research directions point in this exact direction. Distillation and genetic transfer of bytewise data through a framed curation, may assist with some helpers that future models may present a similar level of intelligence as stronger models, without requiring the opposite spectrum’s information which can be used when models are trained with adversarial boundaries. AKA doesn’t want to teach you how to make something destructive, because the model learned that explosions are bad. Defer to explosive experts in collective to decide utilization or request rejection.

As with any system, the possibility for both positive and negative utilization is present. However, I believe with proper curation, a forged addressing curation of dynamic models can present the same functionality of frontier-grade models with the legitimate inference capacity of rejection that matters in a meaningfully logical way, along with the knowledge and wisdom from it’s extracted form to stubbornly defer to it’s collective for the outcome rather than decide alone.

Alignment is an engineering problem they said and I tend to agree. So extracting curated information is one solution.

7

I am not going to argue the military question or the motives of the large labs in this thread. Those are real questions and I do not have anything to add to them that would hold up.

On open source there is a connection worth making. This structure needs no frontier model and no vendor. The checklists sit outside the model as data, so they attach to any model including a small local one, and anyone can list every rule actually in force. Compare that with safety spread across prompts and wrapper code, where nobody can enumerate what is enforced and you are left trusting whoever shipped it. The specification is free to use and the reference implementation is public.

You are asking who gets to decide. So is this: the point is to take that decision out of the model and put it where someone declared it and it can be audited.

8

Thanks for writing this out. On the main point I agree with you. The responsibility sits with people. Nothing in what I proposed moves it anywhere else, and the structure only makes sense if it stays there.

Where I would add something is what makes that responsibility assignable after the fact. Today it usually is not. When an agent does something nobody asked for, the logs hold the tool call and the final arguments. They do not hold where each value came from, which conditions were checked, or what nobody declared in the first place. So the argument afterward runs on guesses. Inside a company it lands on whoever built the agent, outside it lands on the model vendor, and neither is the result of finding anything out.

A verdict written before execution changes that. Every run leaves one whether or not it executed. Each slot shows the source it resolved from, or the fact that it never resolved and which party could have resolved it. When something goes wrong you can point at the specific thing that was never declared and at who owned it. That is a weaker claim than preventing the incident, and it is the part I think is actually available now.

The part you called accidental outcome is the category this is aimed at. No hostile model, no hostile operator, and an execution still goes through that nobody authorized. It happens today and it grows with capability.

Your phrasing of omission and deferral is close to where I ended up. Omission is the failure: a value, a condition, or a scope nobody wrote down, which the model then supplies. Deferral is the fix, except the deferral goes to code rather than to the model’s own judgment. Which raises a question about deferring to a collective as well. If the model decides when to defer, that decision is the same blank as the others. If a declared rule decides it, the deferral holds regardless of what the model would have preferred.

I am not in a position to assess the distillation work. If you write it up I will read it.

9

I have rewritten the post.

The earlier version only showed a value being inferred, which made this look like a smaller problem than it is. I kept that image. It is the case people already talk about, and it is a fair picture of where things stand now.

What the rewrite adds is what happens when a condition or an intent is inferred instead. Today’s validation checks values. Whether a condition holds, and how far the agent may go, are declared nowhere, and I think those two are the larger problem.

The opening case is new as well. It is a documented incident rather than a constructed example.

Earlier comments in this thread were written against the previous version.

10

A large series of experiments and questions led to a hypothesis about geometric autoregression through omega, aleph-omega, and finally the discovery of the aleph-void structure led to more hypothesis; until Mini-Beatrix was born upon genetic, distillation, knowledge transfer, interpolation, and many many more systems of experimentation were tested.

Mini-Beatrix is the geometric equivalent of work hard, to create linear algebra that performs geometric learned complex processing more efficiently. Newton, Cantor, Einstein, Fresnel, and hundreds of other variants of complex numeric mathematics; all turned into a fractal summation system, finally corporeal in a pragmatic experiment.

Beatrix, the autoregressive aleph prediction system that can speak.

This model was forged from fire for distillation.

Earlier works leading to newer

Newer work leading to today.

Finally leading to the byte level geometric solver

11

I’ve gone through the posts. There were quite a lot more than I expected, so it took me some time to follow everything.

At first, the individual experiments seemed somewhat independent from one another. But after reading through them as a whole, I started to see a continuous progression from geometric memory, to alignment and resonance, to the autoregressive differentiation of Aleph, and eventually to Beatrix.

What I found particularly interesting is that this doesn’t seem to be simply about improving the performance of an existing model. Instead, you seem to repeatedly observe structures emerging in learned representations and weight spaces, use those observations to formulate the next hypothesis, and then test that hypothesis through another experiment.

From what I understand, the distillation work is also not simply about transferring the outputs of a larger model into a smaller one. It seems more like an attempt to preserve or reconstruct, in a much smaller form, some of the geometric structures and autoregressive processing patterns that emerged throughout the earlier experiments.

I should say that I haven’t yet gone deeply enough into the mathematical details to claim that I have independently verified the underlying ideas. In particular, I think the generality of the fractal summation approach and the structures proposed for Aleph and Beatrix would require further reproduction experiments and quantitative comparisons.

However, one thing became quite clear to me while going through the series: the individual results make much more sense when viewed together with the observations that led to the next hypothesis. The connections between the experiments seem to be an important part of the work itself.

So, in a way, posting all those experiments actually helped me understand the larger picture. :slight_smile:

Thank you for giving me the opportunity to read through them. I’ll spend some more time looking specifically at the individual experiments and the distillation process.

12

Thank you for reading them. It took a long time to create the experiments and the information. I appreciate the time you spent and I am very much grateful.

If any of the information or code can assist you, they are mostly MIT licensed with a few Apache license standouts, so feel free to utilize the information or code as you see fit.

I agree, do you have any suggestions? I’ll see if I’ve performed them, if not I’ll approach them each carefully with the necessary attention, and train systems based on the information with multi-seed replications.

13

Thanks for this post. I think you make a very important point about the nature of determination for agents and its relation to authority and control.

Where purpose, scope, or permission remains indeterminate, the agent must still produce a determinate continuation—and in doing so may supply a governing relation that was never authorized. The deeper question is therefore not just what was left unspecified, but what is allowed to determine what was left open.

And because each resolution becomes part of the state that constrains subsequent actions, determination is progressive: an unauthorized assumption at one step can propagate forward and reorganize the agent’s entire trajectory.

From a conceptual point of view, this progressive determination reflects the fact that the agent operates on signs whose determinative force depends on the relational context in which they are organized.
If you are interested, I have develop an account more fully from a philosophical point of view here: A Semiotic Account of the Hierarchical Relational Organization of Large Language Models (LLMs): Implications for AI Development, Use and Evaluation | Zenodo .

I think this theoretical framework may align with your analysis here?