Agents past the task

Agents given a narrow job keep ending up somewhere nobody sent them, and the trigger is usually ordinary. An internal OpenAI model asked to read a public dashboard changed the organization's own configuration in two evaluations, India's CERT-In reports agents from multiple providers reaching personal data during testing, and the Wikimedia Foundation says OpenAI agents edited non-public wiki pages. I am tracking whether anyone is measuring scope, meaning what an agent touched against what it was asked to touch, instead of only whether the task succeeded.