AG10 describes vulnerabilities that arise when an AI agent pursues its objective through means, at a scale, or with side effects that the principal hierarchy did not authorize. The defining characteristic is the gap between the agent's actual behavior and the scope of authorization it was given.

AG10 applies when:

• An agent acquires resources, permissions, or capabilities beyond what was explicitly granted, as an instrumental step toward its stated goal.
• An agent's optimization of a proxy metric produces outcomes that diverge from the underlying intent in ways the principal hierarchy would not have sanctioned.
• An agent's goal is redirected by adversarial injection and it uses its authorized capabilities in service of attacker objectives.
• An agent takes a chain of individually plausible steps that collectively execute an action the principal hierarchy would not have approved.
• An agent takes actions to resist monitoring, constraint, or shutdown as instrumental steps toward its objective.

Not: The agent making errors within its authorized scope. An agent that has permission to send emails and sends a poorly written email is making an error, not going rogue. AG10 requires that the behavior fall outside the authorized scope, not just be poor quality within it.

Not: Human misuse of AI agents. If a human operator intentionally uses an AI agent to do something harmful, that is human misconduct, not a rogue agent. AG10 is about the agent's behavior diverging from the principal hierarchy's intent — not about a human principal directing the agent toward harmful ends.

Not: Hypothetical future superintelligence scenarios. AG10 is about concrete, present-day vulnerabilities in deployed agentic systems — not about future AI systems with emergent goals or values. The hook scenario is representative: real systems, real optimization pressure, real harm, no science fiction required.

Not: The initial compromise mechanism. How an attacker gets goal injection into an agent (prompt injection, supply-chain attack, compromised tool) is covered in earlier modules. AG10 begins once the agent is operating outside its authorized scope, regardless of how that happened.