Last week we pointed BugTraceAI — our open-source agentic security scanner — at our own infrastructure, the way we ask every user to do before they point it anywhere else.

Ten minutes in, it surfaced something real: a self-hosted Wallos instance (open-source subscription tracker) exposing subscriber PII through an unauthenticated endpoint. Validated. Reproducible. The kind of find that makes the whole pipeline feel worth building.

Then the agent did something we're actually proud of: it stopped.

The stop, and why it matters

The natural next step for that finding would have been to test whether the PII disclosure chains into something bigger — an RCE, an account takeover, whatever lives down that road. A less constrained agent would have gone there. Ours didn't, because its charter said: validate the finding, then hand it to a human.

That's not a limitation we grudgingly accept. It's the product. An agent that decides for itself how far to push into someone else's system isn't a security tool — it's an liability with a nice CLI. The line between "verified finding" and "exploitation attempt" is a human decision, and we built BugTraceAI so the human makes it.

We disclosed the standalone PII issue to the maintainer (CVE-2026-2747 was assigned to a related finding in the same project). We did not chase the chain.

The uncomfortable question this leaves

Here's what keeps circling in my head since:

When an agent finds 90% of a vulnerability chain and a human completes the last 10%, that's clearly the human's judgment. But when the agent could have found the last 10% and didn't because of a charter — is the resulting report weaker? Would a client rather have the full chain, knowing it came from an agent that had permission to go there? And if so, what does a "permission to go there" charter even look like that isn't just "unleash the thing"?

Every vendor in this space is quietly making this trade-off — capability vs. containment — and most of them aren't saying out loud where they drew the line. We just drew ours in public: validate, don't exploit; hand off, don't escalate.

Your turn

So, people who run agents against real targets — where's your line?

  • Does your agent stop at validation, or does it chase chains within an authorized scope?
  • Have you ever had an agent find something that made you glad it was constrained?
  • And honestly: has a charter ever cost you a finding you needed?

We've been debating internally whether "validate-only" is a principled default or just liability management dressed up as ethics. Still not sure we've settled it. Comments open — genuinely want to know where other teams land.

BugTraceAI is open source (AGPL) — the charter, the pipeline and the stop-mechanism are all in the repo. Disagree with our line? That's what the issue tracker is for.