12Identity & fraudBelow the top 20
A tax agent that filed the wrong year
CapabilityAffordanceImpact domainBoth
Statement (NASA form)
Given that seasonal helpers already submit with a stored credential, there is a possibility of a penalty in your name you did not review resulting in the IRS letter arriving for a bot’s mistake.
Likelihood
3Probable
Consequence
3Major
Urgency
3Priority
Personal slice · money. Experimental household card. Not a certified finding.
Composite 12 = 3×3 + 3
Applicable mitigations
Controls · Pace rules: no irreversible action faster than a human can reconstruct it · A real off-ramp that still functions · Contract-first delegation with privilege attenuation · Duty of care on high-stakes delegates · Short-lived, narrowly scoped tokens for every tool call · Mandatory secret scanning before a skill can be listed · No shared tool state across agent sessions · Out-of-band confirmation on a known number