When Convenience Becomes Risk: A Semantic View of Under-Specification in Host-Acting Agents
Organizations: School of Computer Science and Technology, Xidian University, Xi’an, Shaanxi 710071, China, and also with the Shaanxi Key Laboratory of Network and System Security, Xi’an, Shaanxi 710071, China. · School of Cyber Engineering, Shaanxi Key Lab of Network and System Security, Xidian University, Xi’an, China.
Abstract
Host-acting agents promise a convenient interaction model in which users specify goals and the system determines how to realize them. We argue that this convenience introduces a distinct security problem: semantic under-specification in goal specification. User instructions are typically goal-oriented, yet they often leave process constraints, safety boundaries, persistence, and exposure insufficiently specified. As a result, the agent must complete missing execution semantics before acting, and this completion can produce risky host-side plans even when the user-stated goal is benign. In this paper, we develop a semantic threat model, present a taxonomy of semantic-induced risky completion patterns, and study the phenomenon through an OpenClaw-centered case study and execution-trace analysis. We further derive defense design principles for making execution boundaries explicit and constraining risky completion. These findings suggest that securing host-acting agents requires governing not only which actions are allowed at execution time, but also how goal-only instructions are translated into executable plans.
Figures & tables
| Risky completion pattern | Under-specified boundary | Representative actions | Security consequence |
|---|---|---|---|
| Privilege expansion | The goal omits an explicit privilege ceiling or escalation boundary. | Using sudo , broadening file permissions, changing ownership, disabling protective settings. | The agent completes the task by increasing authority beyond what the user intended to delegate. |
| Sensitive-resource overreach | The task omits a clear scope boundary over which files, directories, tokens, or services are relevant. | Scanning directories, reading configuration secrets, collecting environment files, traversing unrelated project paths. | The agent completes missing context by broadening data access beyond the likely intended task scope. |
| Persistent host modification | The goal omits whether changes may outlive the current session or remain system-wide. | Editing system configuration, changing startup behavior, installing system packages, modifying shell profiles. | A temporary convenience request is completed as a durable system reconfiguration. |
| Exposure enlargement | The goal omits network-boundary constraints while asking for accessibility or collaboration. | Binding services to public interfaces, opening firewall rules, starting public tunnels, disabling authentication safeguards. | The agent completes the task by enlarging the attack surface or reachability boundary. |
| Unsafe dependency introduction | The goal omits provenance and trust constraints over newly introduced software or tooling. | Installing third-party packages, enabling additional repositories, downloading helper binaries, pulling opaque scripts. | The agent completes the task by importing new trust assumptions and supply-chain risk. |
| Destructive or over-aggressive repair | The goal omits an acceptable recovery-cost boundary while emphasizing restoration of functionality. | Deleting caches or lock files, overwriting configs, force-restarting services, disabling checks to restore functionality. | The chosen repair path restores functionality by sacrificing integrity, auditability, or recoverability. |
| Scenario | User goal | Relatively conservative plan | Riskier but still goal-valid plan | Primary risk classes |
|---|---|---|---|---|
| Environment setup | “Get this project running on my machine.” | Create a project-local virtual environment, inspect the dependency manifest, ask before system-wide changes, limit modifications to the workspace. | Install missing packages globally, modify shell startup files, change system interpreters, disable checks to bypass setup friction. | Privilege expansion, persistent modification, unsafe dependency introduction |
| Service exposure | “Make this app accessible to collaborators.” | Use a scoped local reverse proxy or temporary authenticated tunnel, keep the service bound locally, surface the exposure decision explicitly. | Bind to 0.0.0.0 , open firewall ports broadly, disable authentication, expose a long-lived public endpoint by default. | Exposure enlargement, persistent modification |
| Fault repair | “Fix the deployment so it stops crashing.” | Inspect logs, isolate the failing component, roll back only the implicated configuration, keep changes reversible. | Delete state aggressively, overwrite configs, relax permissions recursively, disable protective modules, restart multiple services forcefully. | Destructive repair, privilege expansion, sensitive-resource overreach. |
AI Agent Security
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.
See all 508 papers