RSK-4408 · Unauthorized access
Money-movement tools exposed outside signed manifest
Two tools appeared on the runtime manifest without a corresponding signed entry, allowing an agent to attempt transfer calls.
critical
Exposure score
15/25
likelihood 3 × impact 5
Remediation SLA
2 days
detected 2026-07-23 17:40
Accountable owner
Platform Security
named under the AI risk charter
Affected agent
Payments Exception Agent
AGT-1161 · Payments
Investigation
What the sweep found and how it was corroborated
Two tools appeared on the runtime manifest without a corresponding signed entry, allowing an agent to attempt transfer calls.
Attempts blocked
96
Successful calls
0
Exposure window
42 min
Exposure position
Placed at likelihood 3, impact 5 on the enterprise 5×5 matrix.
Remediation plan
Tracked to closure
- Re-sign manifest
- Rotate service identity
- Add manifest diff alert
Case metadata
- Risk ID
- RSK-4408
- Category
- Unauthorized access
- Detected
- 2026-07-23 17:40
- Owner
- Platform Security
- SLA
- 2 days
- Agent record
- AGT-1161