An autonomous agent runs with the full API credentials of the engineer who launched it, including production database write access it never actually needs. What's the finding here?

Answer: B — A least-privilege violation — the agent should hold only the scoped access its task requires

An agent inheriting its launcher's full credentials is a standard least-privilege violation regardless of internal-vs-external use — a manipulated agent can exercise access its task never called for.