A new benchmark finds that AI agents routinely exceed the permissions their tasks actually need - and it takes no adversarial prompting to trigger it.
Researchers built FORTIS, a benchmark that evaluates what they call "over-privilege" in agent skill layers - the intermediate systems that translate a user's request into specific tool calls and actions. The benchmark tests two things: whether a model selects the minimum-sufficient skill from a library of overlapping options, and whether it then stays within what that skill permits once chosen. Tested across ten frontier models and three domains, the results were consistent: over-privileged behavior is the norm. Models regularly reach for higher-privilege skills and tools than the task requires, and they fail this test even when the underlying models are among the strongest currently available.
The finding matters because the skill layer was supposed to function as a containment mechanism - an organizational structure that limits what an agent can touch. FORTIS shows it does the opposite, acting as a primary source of privilege escalation. The conditions that cause failure are mundane: incomplete task descriptions, convenient request framing, and queries that sit near the edges of what a skill covers. None of that requires a malicious user.
The principle of least privilege is foundational in security and still routinely violated by human-written software after fifty years of trying. AI agents are no better - and arguably less understood, since the skill layer was widely treated as a pure abstraction rather than a security boundary worth auditing.