Tenable says its own agent planned bulk changes across assets the requester could not modify

The failure list is the part worth reading, because it is specific and it is the vendor's own. In Tenable's platform, critical severity findings and critically rated assets are different objects, and "clean up" can mean remediate, accept the risk, or delete outright, so "clean up my criticals" resolves to more than one target set and more than one action ^[6]. A capable model picks one and plans bulk changes across assets the requester cannot see, let alone modify ^[6]. Tenable says the model has no concept of who is asking, does not know the entitlement model, and will not infer one ^[7].

The second class is fabrication about the tenant. The model reported that tags did not exist when they did, missed asset searches by IP address, used an underscore where the platform expects a colon, and then reported its own failure as an absence of data ^[8]. "A model that has read the entire internet still has not read your tenant, and it will fill that knowledge gap with plausible invention unless you stop it," Tenable wrote ^[9].

Then the boring limits. A query spanning more than 5,000 assets exhausted the context window and failed outright rather than degrading, relative time ranges crashed sessions, and an unbounded filter such as "all assets where source contains servicenow" would run until something gave out ^[10][11]. Broad objectives failed as well: "give me a weekly security posture summary" did not work because the model would not reliably break the objective into the sequence of scoped queries that answers it, while decomposed requests did work ^[12]. Tenable describes the result as "an ambiguous refusal, which is worse than a wrong answer because the user cannot tell whether the product is incapable or they phrased the request poorly" ^[13].

Map the harness controls onto those failures and the coverage is uneven. Scoping context and tool access answers the authority problem directly, since an agent that cannot see assets outside the requester's entitlements cannot plan changes to them ^[3]. Fabrication and the scale failures are not prevented by scoping. They are caught, if at all, by the human who has to approve a change before it executes and by the record of what the agent proposed ^[4][5][18].

"Every security vendor has an AI agent. The demos are good. They are supposed to be good, because a demo runs against data that nobody minds breaking," Tenable wrote ^[16]. The three questions it puts after the demo are what happens when the agent is wrong, what happens when someone feeds the agent a prompt designed to manipulate it, and what evidence exists afterward about what the agent did and who authorized the action ^[14]. Two of those the post answers with examples. The manipulation question it raises and does not return to, and nothing in the disclosed failure set is an adversarial prompt ^[17]. There are no failure rates, no dates, and no third-party testing in the account either ^[19].

"The model is the part you can subscribe to. The harness is the part that has to be built, and it represents most of the work of building an agentic AI capability," Tenable wrote ^[15].