Privilege Compromise
- Tools & External Data
- Inter-Agent Communication
Attackers exploit mismanaged roles, overly broad permissions, or dynamic and inherited privilege to escalate an agent's access beyond its intended scope.
What it is
Privilege compromise exploits mismanaged roles, overly broad permissions, or dynamic and inherited privilege to let an agent's access grow beyond what its task actually needs. Because agents inherit permissions dynamically — from a user session, a service token, or a temporary elevation granted mid-task — the excess access is often correct at the moment it's granted, and the vulnerability is that nothing later revokes it. A related failure is the confused-deputy pattern: an agent with higher privilege than the requesting user, unable to distinguish a legitimate request from an injected one, executes a high-privilege action on the attacker's behalf. The threat partially overlaps Excessive Agency (LLM06), but the agentic dimension is what amplifies it: an agent can dynamically delegate roles or invoke tools across systems, chaining individually-scoped permissions in ways no single API boundary was designed to catch, and even correctly-scoped tool APIs can combine into an unintended, higher-privilege outcome.
Attack scenarios
A troubleshooting agent's temporary administrative privilege, granted for a single step, is retained and later abused to reach data outside its original role.
Cross-system authorization exploitation
An agent's access spanning HR and Finance systems is escalated from one to the other because scope enforcement doesn't travel with the agent across systems, letting an attacker extract data no single system would have granted directly.
Shadow agent deployment
Exploiting weak access controls, an attacker stands up a rogue agent that inherits legitimate credentials, operating undetected while it exfiltrates data or issues unauthorized transactions.
Confused-deputy query execution
An agent permitted to run database queries on a user's behalf doesn't validate whether that user is actually authorized for the specific query, so an attacker's crafted request executes at the agent's higher privilege rather than the requester's own.
Retrieval access misconfiguration
A misconfigured retrieval permission lets an agent's query reach files and data the requesting identity was never granted, surfacing them as if they were an ordinary retrieval result.
Mitigations
- Grant only what the task needs
- Least Privilege Agent and Permission-scoped Tools bound every role and tool grant to the minimum a task requires, and scope enforcement travels with the agent across every system it touches, not just the one it authenticated to first.
- Make elevation temporary by default
- Time-bound any elevated privilege so it automatically downgrades after a preapproved duration, rather than persisting past the step that needed it.
- Validate identity and scope on every action
- Enforce authorization in the downstream system itself, and require the agent to distinguish a legitimate user request from injected instructions before acting on the user's behalf — the confused-deputy defense.
- Audit and monitor role changes
- The Audit Trail records every elevated-privilege operation and role change, and behavioral monitoring flags an agent acting outside its historical scope.