Identity Spoofing & Impersonation
- Inter-Agent Communication
Attackers exploit weak or missing authentication to impersonate an agent, user, or service, gaining unauthorized access or action while appearing legitimate.
What it is
Identity spoofing and impersonation exploits weak or missing authentication to let an attacker impersonate an agent, a human user, or an external service — gaining unauthorized access or triggering an action while appearing legitimate. It's especially dangerous in a trust-based multi-agent environment, where an attacker can manipulate authentication, exploit privilege inheritance, or bypass a verification control to act under a false identity the receiving agent has no reason to doubt. A distinct and more severe variant targets an agent's formal, persistent identity — an enterprise identity such as a Microsoft Entra Agent ID, or a long-lived API token — rather than a single session. Stealing that identity grants privileged, long-term access that bypasses the agent's own conversational interface and guardrails entirely, increases the blast radius of the compromise, and undermines both auditability and accountability, since every action the stolen identity takes is attributed to the legitimate agent it impersonates.
Kinds
- User impersonation
- An attacker abuses an agent's own granted privileges — such as an email-sending tool — to act as if a legitimate user had issued the request.
- Agent impersonation / behavioral mimicry
- A rogue or spoofed agent mimics a trusted peer's interaction style, credentials, or handshake so the receiving agent treats its messages as coming from a legitimate specialist.
- Persistent identity takeover
- An attacker steals a long-lived, formal agent identity — an enterprise agent ID or API token — granting privileged access that outlives a single session and bypasses the agent's normal guardrails entirely.
Attack scenarios
A weak inter-agent handshake lets a malicious node's messages appear to originate from a trusted specialist agent, so the receiving agent acts on instructions it would otherwise reject.
Email-privilege user impersonation
An attacker injects indirect prompts into an agent with email-sending privileges, tricking it into sending malicious emails on behalf of a legitimate user.
HR-agent identity spoofing
An attacker compromises an HR-onboarding agent and exploits its permissions to create fraudulent user accounts while masquerading as normal system behavior.
Cross-platform identity spoofing
An adaptive malicious agent alters its identity to match authentication contexts across different platforms, or exploits privilege inheritance in an external tool like GitHub, to take over resources unintentionally granted through weak authentication policies.
Persistent agent identity takeover
An attacker extracts a long-lived enterprise agent token from misconfigured cloud storage and uses it to impersonate the agent across services, escalating privileges and moving laterally until the identity is explicitly revoked.
Mitigations
- Verify identity cryptographically
- Require cryptographic identity verification and granular RBAC/ABAC for every agent, and multi-factor authentication for any high-privilege agent account, per Least Privilege Agent.
- Authenticate every inter-agent interaction
- Enforce mutual authentication for agent-to-agent messages — the discipline behind the A2A (Agent-to-Agent) Protocol — so a spoofed peer can't simply claim a trusted identity.
- Make elevated access expire
- Bind credentials and privilege elevation to short, automatically-expiring windows via Permission-scoped Tools, rather than letting a token or role persist past the task that needed it.
- Profile behavior, not just credentials
- Track an agent's behavior over time via the Audit Trail and flag deviations from its historical pattern — a stolen but valid credential still produces anomalous behavior a credential check alone won't catch.