The Attack Was Authorized: The Missing Security Boundary for AI Agents