Unrestrained Agent
Permissions bypassed + shell-capable hook or skill
Every AI action can execute commands with no human gate.
AIRES · AI RISK EXPOSURE SCORE
The score that
explains itself.
AIRES stands for AI Risk Exposure Score. It turns forty-three categories of endpoint evidence into one 0–100 number per machine — and every point traces back to a finding you can open.
0 / LOWER EXPOSURE100 / HIGHER EXPOSURE
01HOW THE NUMBER IS BUILT
Follow the score
back to the evidence.
AIRES scores five dimensions — capability, egress, data exposure, credentials, and governance. It then accounts for detection confidence and combinations of findings that create a larger exposure together.
The example mirrors the DEV-12 view in AISpy. The endpoint score, dimension values, contributing factors, scenario multiplier, and counterfactual all remain visible.
AISpy / Risk Scores / DEV-12
CRITICAL RISK76 / 100
Confidence-weighted across 5 resolved exposures, coupled by a ×1.396 threat scenario and calibrated to p=0.89.
Counterfactual: Removing the filesystem MCP server drops this endpoint from 76 to 57.
Risk dimensions
- Capability84.3
- Egress40.8
- Data exposure0.0
- Credential0.0
- Governance75.9
Top contributing factors
- 1filesystem (MCP server)
- 2claude code: PostToolUse:* (AI hook)
- 3claude code (permission bypass)
- 4Claude Code (LLM client)
- 5deploy (AI skill)
Threat scenario×1.396 Unrestrained Agentpermissions bypassed + shell execution
02PRESENCE VERSUS BEHAVIOR
Approve the tool.
Keep the risk visible.
Sanctioning a tool lowers its presence weight — an approved coding assistant is visible but quiet. It never lowers a leaked key, a bypassed permission gate, a shell-running hook, or a malicious model. Approving the vendor never approves the dangerous configuration.
Sanctioning is an administrator’s decision. It is context entered into AISpy, not an approval that the scanner discovers.
AISpy / AIRES scoringIllustrative example
RISK SCORING
The exposure behind the number.
EXAMPLE AIRES SCORE
High risk65.5/ 100
AI outside your approved baseline
Unapproved AI capabilities warrant investigation. Review the findings that contribute to the score and the exposure behind them.
Policy contextNot sanctioned
NEXT STEP
Review exposure and assign ownership
03DETECTION SCENARIOS
Combinations score
as what they are.
Exposed Runtime
Local model + listener bound to 0.0.0.0
The model listens beyond localhost. Other machines may reach it where network controls permit.
Credential-to-Agent
Leaked API key + autonomous agent on the same box
An autonomous agent shares a machine with exposed cloud credentials; investigate whether the agent can access them.
Malicious Model
Unsafe/pickle payload + evidence the model was loaded
Code execution has plausibly already happened. Loading evidence calls for investigation; it does not alone prove payload execution.
04CONFIDENCE, FRESHNESS & LABELS
The evidence has a strength.
And a shelf life.
Each finding carries its detection confidence and an evidence label; stale evidence decays toward “unknown.” The score is a prioritization model, not a breach probability.
A configuration reference cannot establish data transfer. Use the number alongside what was observed, what the scan covered, and what remains unverified.
05FROM ENDPOINT TO ORGANIZATION
A clean average cannot
hide a rogue machine.
Endpoint scores roll up to an organizational exposure figure and the AI Maturity Scorecard — seven subscores including shadow-AI control. The scorecard is capped whenever any unsanctioned autonomous agent exists on the fleet: a clean average never hides one rogue machine.
06CALIBRATED AGAINST KNOWN-TRUTH MACHINES
Test the method
against your baseline.
AIRES is tuned on labeled fixtures — a clean build, a machine running only sanctioned AI, a machine running a shadow agent — with a repeatable harness that tests their separation. Customers can run the same harness against their own golden image.
Clean buildSanctioned AIShadow agent
Fixture results describe the configurations tested. They are not an accuracy guarantee for an untested environment.
07READING A SCORE
The number starts
the investigation.
In this demo capture, removing the filesystem MCP exposure changes the counterfactual score from 76 to 57. This is a model estimate for that single change; verify the outcome with a covered rescan.
SEE YOUR EXPOSURE IN CONTEXT