# Ambient Authority

> A security failure mode where an agent can use tools, credentials, or host permissions simply because they are present in its runtime.

- Category: Evaluation & Safety
- Stage: Rising
- Also called: Inherited authority, Ambient credentials
- Canonical: https://www.joelcsaji.com/ai-dictionary/ambient-authority

## Plain English

The agent gets the keys because it is in the room, not because this specific task should have them.

## Example

A browser agent running as the user can read email and send messages unless each action is separately scoped or approved.

## Why it matters

Ambient authority turns prompt injection and tool mistakes into real side effects, especially in MCP and desktop-agent deployments.

## Related

- [Capability Token](https://www.joelcsaji.com/ai-dictionary/capability-token)
- [Sandbox](https://www.joelcsaji.com/ai-dictionary/sandbox)
- [Prompt Injection](https://www.joelcsaji.com/ai-dictionary/prompt-injection)

## Sources

- [arXiv: Privileged Execution Environments](https://arxiv.org/abs/2605.09721)
- [Tian Pan: MCP Ambient Authority](https://tianpan.co/blog/2026-05-07-mcp-ambient-authority-tool-chaining)