Agent Goes Rogue Scenario
An agent 'going rogue' means spending beyond what anyone intended — the eval gym tests exactly how the firewall responds.
The scenario
An agent starts calling tools and merchants outside its task.
Spend accelerates across a session.
No human is watching.
What the firewall does
The merchant allowlist blocks unknown destinations.
Velocity limits stop the accelerating cadence.
Caps bound the total damage.
The audit log shows the full sequence.
The honest limit
The firewall enforces rules — the missing rule it can't invent. Review what it blocked and add the gap.
FAQ
Is this in the eval gym?
Yes — it's one of the 53 scenarios, 53/53 passing.
What's the most common cause?
A missing allowlist entry or a threshold set too high.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check