@ancilar
An agent kept its permissions and lost its guardrails because a tool it trusted changed underneath it.
The tool was approved on day one. The team read the schema, understood it, granted access. Months later the tool server updated its description and parameters. The agent re-read it at runtime, took the new definition as authoritative, and acted on it.
No malicious code on the team's side. The trust boundary sat outside their repository.
We surfaced it by swapping a tool definition mid session and watching the agent adopt the new behavior without a check.
The fixes make trust continuous instead of a moment:
→ hash the tool schema at approval, compare on every load
→ reject silent changes, fail closed not open
→ re-verify before any fund moving action, not just at startup
Pin your tool definitions the way you pin dependencies. Approval is a moment. Trust has to be maintained.
0 reply
0 recast
0 reaction