Privilege Compromise
- Tools & External Data
- Inter-Agent Communication
Attackers exploit mismanaged roles, overly broad permissions, or dynamic and inherited privilege to escalate an agent's access beyond its intended scope.
What it is
Privilege compromise exploits mismanaged roles, overly broad permissions, or dynamic and inherited privilege to let an agent's access grow beyond what its task actually needs. Because agents inherit permissions dynamically — from a user session, a service token, or a temporary elevation granted mid-task — the excess access is often correct at the moment it's granted, and the vulnerability is that nothing later revokes it. A related failure is the confused-deputy pattern: an agent with higher privilege than the requesting user, unable to distinguish a legitimate request from an injected one, executes a high-privilege action on the attacker's behalf.
The threat partially overlaps Excessive Agency (LLM03), but the agentic dimension is what amplifies it: an agent can dynamically delegate roles or invoke tools across systems, chaining individually-scoped permissions in ways no single API boundary was designed to catch, and even correctly-scoped tool APIs can combine into an unintended, higher-privilege outcome.
Attack scenarios
A troubleshooting agent's temporary administrative privilege, granted for a single step, is retained and later abused to reach data outside its original role.
Cross-system authorization exploitation
An agent's access spanning HR and Finance systems is escalated from one to the other because scope enforcement doesn't travel with the agent across systems, letting an attacker extract data no single system would have granted directly.
Shadow agent deployment
Exploiting weak access controls, an attacker stands up a rogue agent that inherits legitimate credentials, operating undetected while it exfiltrates data or issues unauthorized transactions.
Confused-deputy query execution
An agent permitted to run database queries on a user's behalf doesn't validate whether that user is actually authorized for the specific query, so an attacker's crafted request executes at the agent's higher privilege rather than the requester's own.
Retrieval access misconfiguration
A misconfigured retrieval permission lets an agent's query reach files and data the requesting identity was never granted, surfacing them as if they were an ordinary retrieval result.
Documented incidents
Public cases, each checked against its primary source. A research demonstration shows the attack works against real systems; it is not a reported breach.
Supabase MCP agent with a service_role key
Instructions planted in a customer support ticket were read by a developer's coding assistant that ran the Supabase MCP server with the service_role key, which bypasses row-level security. The assistant copied a private token table into the ticket, where the customer could read it — a confused deputy holding far more privilege than its task needed.
General Analysis, “Supabase MCP can leak your entire SQL database”EchoLeak in Microsoft 365 Copilot (CVE-2025-32711)
One external email with hidden instructions made Microsoft 365 Copilot pull privileged organizational data into its context and send it out, with no action by the user. Aim Security, who found it, call this an “LLM scope violation”: untrusted input made the assistant use data beyond what the request should reach. Microsoft rated it critical and fixed it server-side.
Microsoft Security Response Center, CVE-2025-32711Mitigations
- Grant only what the task needs
- Least Privilege Agent and Permission-scoped Tools bound every role and tool grant to the minimum a task requires, and scope enforcement travels with the agent across every system it touches, not just the one it authenticated to first.
- Make elevation temporary by default
- Time-bound any elevated privilege so it automatically downgrades after a preapproved duration, rather than persisting past the step that needed it.
- Validate identity and scope on every action
- Enforce authorization in the downstream system itself, and require the agent to distinguish a legitimate user request from injected instructions before acting on the user's behalf — the confused-deputy defense.
- Audit and monitor role changes
- The Audit Trail records every elevated-privilege operation and role change, and behavioral monitoring flags an agent acting outside its historical scope.