XBOW: Legal Boundaries of AI Penetration Testing

What it is

XBOW's engagement-design guidance for authorizing AI penetration tests. Beyond the exposure sources the summary lists, the page names the core failure mode — authorization drift — and gives concrete requirements teams should put in scope documents and enforce technically before an autonomous agent runs.

How it works

Authorization drift is when an agent moves beyond intended scope without a person approving that step: reaching an unapproved asset, touching a third party, accessing more data than intended, or using a prohibited technique. A human tester pauses at an unexpected dependency and asks whether it's still in scope; an autonomous platform must enforce that same decision point itself. The page's framing: liability turns on the actions actually performed, not just the permissions documented beforehand, so broad scope language plus weak controls plus incomplete records is the combination that makes liability hard to assign.

What to do

The page's concrete checklist for a defensible engagement — authorized, bounded, reviewable, and designed to stop when risk increases:

• Define where the agent may operate, which actions are prohibited, and when human approval is required (escalation points).
• Identify third-party dependencies (cloud, SaaS, shared hosting, adjacent systems) and confirm provider permission before testing — owning the app doesn't mean owning everything the agent can reach.
• In the rules of engagement, explicitly state whether the agent may view, store, copy, or simulate exfiltration of encountered data (credentials, tokens, PII, session/production records), plus masking, retention, and deletion requirements.
• Back written terms with platform controls that enforce limits and record any action that approaches them, so the test is evaluated from evidence rather than reconstructed intent.
• Map legal exposure across overlapping regimes before starting and have counsel verify jurisdiction-specific claims.

Caveats

This is engagement-design guidance, not legal advice — the page repeatedly directs practitioners to confirm obligations with counsel, and provides no tooling, commands, or reference implementation. The supporting statistics come from an April 2026 Cloud Security Alliance study: 53% of organizations reported AI agents exceeding intended permissions at least occasionally, and 47% experienced a security incident involving an AI agent — figures worth verifying against the primary source before citing. The fetched text cuts off mid-section ("What does permission mea…"), so the page's definition of permission is not captured here.