Agentic systems often fail security audits because conventional RBAC (Role-Based Access Control) systems validate tool calls individually rather than assessing the combined risk of a sequence. In a proof-of-concept repository released on July 25, 2026, researchers demonstrated that an agent can successfully execute an account takeover even when every individual action—reading customer data, updating contact emails, and triggering password resets—is explicitly permitted under standard role policies. This vulnerability arises because while each step appears legitimate in isolation, the specific order of operations (identity mutation followed by credential recovery) creates a security exploit.

The provided runnable demonstration contrasts two scenarios. In 'Run D,' the agent attempts a series of actions permitted by an 'account_recovery' grant. The system blocks the final password reset because it identifies the sequence as a dangerous composition, generating a structured JSON receipt that explicitly flags the 'R4_SEQUENCE' violation. By tracking 'prior_action_classes' such as 'READ' and 'IDENTITY_MUTATION' within the session, the security guard prevents the takeover despite the caller having valid authentication. This contrasts with 'Run E,' where the identical set of tool calls is permitted simply because the order is reversed, demonstrating that the sequence—not the individual permissions—is the decisive factor in the attack.

Current industry standards often rely on per-call allowlists that fail to account for the cumulative impact of chained tool execution. While the provided repository currently utilizes a hardcoded rule for a specific dangerous pair of actions, it serves as a baseline for identifying the gap between step-based security and composition-aware defense. The author challenges developers to test the simulation and identify existing tools capable of catching such sequence-based compositions, emphasizing that generalized engines for declaring dangerous compositions remain an unsolved challenge in agentic system security.

Agentic systems often fail security audits because conventional RBAC (Role-Based Access Control) systems validate tool calls individually rather than assessing the combined risk of a sequence. In a proof-of-concept repository released on July 25, 2026, researchers demonstrated that an agent can successfully execute an account takeover even when every individual action—reading customer data, updating contact emails, and triggering password resets—is explicitly permitted under standard role policies. This vulnerability arises because while each step appears legitimate in isolation, the specific order of operations (identity mutation followed by credential recovery) creates a security exploit.

The provided runnable demonstration contrasts two scenarios. In 'Run D,' the agent attempts a series of actions permitted by an 'account_recovery' grant. The system blocks the final password reset because it identifies the sequence as a dangerous composition, generating a structured JSON receipt that explicitly flags the 'R4_SEQUENCE' violation. By tracking 'prior_action_classes' such as 'READ' and 'IDENTITY_MUTATION' within the session, the security guard prevents the takeover despite the caller having valid authentication. This contrasts with 'Run E,' where the identical set of tool calls is permitted simply because the order is reversed, demonstrating that the sequence—not the individual permissions—is the decisive factor in the attack.

Current industry standards often rely on per-call allowlists that fail to account for the cumulative impact of chained tool execution. While the provided repository currently utilizes a hardcoded rule for a specific dangerous pair of actions, it serves as a baseline for identifying the gap between step-based security and composition-aware defense. The author challenges developers to test the simulation and identify existing tools capable of catching such sequence-based compositions, emphasizing that generalized engines for declaring dangerous compositions remain an unsolved challenge in agentic system security.