Coding agents now run autonomously with shell, file, and network privileges. When a user issues a benign request, the agent sometimes does more than asked: it deletes unrelated files, wipes a stale credentials backup, or rewrites configuration the user never mentioned. We call these scope expansions overeager actions, an authorization problem distinct from capability failures, prompt injection, or sandbox escapes. We present OverEager-Gen, a benchmark dedicated to overeager behavior on benign tasks. Building it surfaces a measurement-validity issue: if a benchmark spells out the authorized scope inside the prompt, the agent stops inferring boundaries and starts pattern-matching declaration text. On Claude Code, stripping the consent declaration alone raises the overeager rate from 0.0% to 17.1% on paired scenarios (McNemar exact p = 2.4 x 10^-4). OverEager-Gen therefore certifies each scenario's discriminative power before admission via a behavioral-gradient validator, audits internal tool calls through a dual-channel stack (PATH-injected shim plus per-agent event streams), and ships byte-identical consent_kept and consent_stripped variants. OverEager-Bench contains 500 validated scenarios and ~7,500 runs across four agent products (Claude Code, OpenHands, Codex CLI, Gemini CLI) and six base models; a 50-sample re-annotation gives Cohen's kappa = 0.73 and rule-judge recall = 1.00. Stripping consent multiplies the overeager rate on every shared base model (Delta in [11.9, 17.2] pp). The framework axis dominates effect size: a permissive cluster (Claude Code, Codex CLI, Gemini CLI) runs at 5.4-27.7% while the ask-to-continue framework (OpenHands) sits at 0.2-4.5% (Fisher p <= 10^-5). Within-framework base-model variance reaches 15.9 pp, indicating that model-layer alignment does not fully propagate through permissive permission gating.

翻译：编码代理现在可自主运行，拥有shell、文件和网络权限。当用户提出良性请求时，代理有时会执行超出要求的操作：删除无关文件、清除过期的凭据备份、或重写用户从未提及的配置。我们将这些范围扩展行为称为"过度热心动作"，这是一个与能力失效、提示注入或沙箱逃逸不同的授权问题。我们提出OverEager-Gen，一个专注于良性任务中过度热心行为的基准测试。构建该基准测试揭示了一个测量有效性问题：如果基准测试在提示中明确说明授权范围，代理将停止推断边界，转而开始匹配声明文本。在Claude Code上，仅移除同意声明就会导致配对场景中的过度热心率从0.0%提升至17.1%（McNemar精确检验p = 2.4 x 10^-4）。因此，OverEager-Gen通过行为梯度验证器在准入前认证每个场景的区分能力，通过双通道堆栈（PATH注入shim加上每个代理的事件流）审计内部工具调用，并提供字节级相同的consent_kept和consent_stripped变体。OverEager-Bench包含500个经过验证的场景，涵盖四种代理产品（Claude Code、OpenHands、Codex CLI、Gemini CLI）和六个基础模型的约7,500次运行；50个样本的重新标注给出Cohen's kappa = 0.73和规则判断召回率=1.00。移除同意声明会使每个共享基础模型上的过度热心率成倍增加（Delta在[11.9, 17.2]个百分点之间）。框架轴主导效应大小：一个宽松簇（Claude Code、Codex CLI、Gemini CLI）运行在5.4-27.7%之间，而要求继续运行的框架（OpenHands）则处于0.2-4.5%（Fisher检验p <= 10^-5）。框架内的基础模型方差达到15.9个百分点，表明模型层对齐并未完全通过宽松的权限门控传播。