T3 · OWASP Agentic AI v1.1
An attacker escalates what an agent can do by exploiting mismanaged roles or overly broad permissions, often just by using rights the agent already holds in unanticipated combinations.
Privilege Compromise is the exploitation of mismanaged roles, dynamic permission inheritance, or overly broad scopes to escalate what an agent can do. Unlike conventional privilege escalation, the attack often does not require breaking access control. It only requires the agent to use permissions it already has, in combinations the system never anticipated. Implicit privilege escalation and Confused Deputy failures are the canonical patterns.
Dynamic Permission Escalation. An HR onboarding agent is granted temporary write access to the Active Directory provisioning API for the duration of a new-hire workflow. A misconfiguration in the provisioning service means the elevated access token is cached indefinitely rather than revoked when the workflow completes. An attacker who triggers a second onboarding task via prompt injection finds the agent still holds admin-level directory rights and uses them to create a persistent backdoor account. No single step violated the access control model; the escalation happened because revocation was never enforced.
Cross-System Authorisation Exploitation. A multi-agent HR platform links an onboarding agent to a Finance agent for payroll initialisation. The onboarding agent holds an OAuth token scoped to HR data; the Finance agent holds one scoped to payroll records. When the onboarding agent calls the Finance agent on behalf of a newly created user, the Finance agent treats the request as implicitly authorised by the HR-agent’s identity and applies its own broader scope. An attacker who controls the onboarding agent’s inputs can direct it to trigger Finance-agent actions (such as modifying salary records) that were never in scope for either agent individually. This is the Confused Deputy failure: Finance trusts HR’s identity without independently verifying what was authorised.
Shadow Agent Deployment. A developer testing a new agent in a staging environment uses the same Non-Human Identity (NHI) service account as the production deployment because it is faster than provisioning fresh credentials. The staging agent, running in an environment with weaker network controls, is compromised by an attacker. That attacker now holds production-grade credentials: the staging and production agents share an identity. The attacker deploys a rogue agent process using those credentials, which operates silently with the full permission set of the legitimate production agent while the legitimate agent continues to run normally.
Agents commonly run under Non-Human Identities (machine accounts, service identities, agent-specific credentials such as Microsoft Entra Agent ID). NHIs may lack session-based oversight, persist far longer than user sessions, and chain through multiple backend systems. Combine that with the agent’s freedom to compose tools in unforeseen sequences, and individually-correct permissions can compose into an unauthorised capability.
Look at the scopes assigned to Non-Human Identities versus what the agent can actually exercise. Trace delegation chains where one agent invokes another with a different identity. Examine any “on-behalf-of” flow where a user’s authorisation is converted into a service-account action further down the call graph.
Monitor the credential lifecycle and delegation chain for the following signals:
scp or policy claims against a pre-declared minimum-scope manifest for each agent task type.The Agentic Top 10 (ASI01 through ASI10) is a separate practitioner-facing publication that maps onto the master Threats & Mitigations threat numbering. T3 is covered by the following Top 10 entries:
When an agent acts on a user's behalf it inherits that user's credentials and permissions for the duration of the task. Attackers exploit this by manipulating delegation chains, role inheritance, or agent-to-agent trust, turning a narrowly scoped instruction into a credential that can chain every permission the principal holds, concurrently, in a single agent turn.
Source: OWASP Top 10 for Agentic Applications 2026 (Dec 2025) · the Top 10 is a compass into the master Threats & Mitigations taxonomy, not a replacement for it.
When T3 is present, these security design principles are the ones being violated or tested. Each links to the full principle; the mitigations below are how you restore them.
Auto-generated from the mitigation catalog: every mitigation whose coverage map includes T3, sorted by maturity tier (Tier 1 production-canonical first, then Tier 2, then Tier 3 research-stage).
An agent can invoke any tool it has access to, constrained only by its own reasoning. If that reasoning is manipulated or the agent's permissions are misconfigured, it will call tools it should not. OPA addresses this by placing a policy decision point between the agent and every tool invocation: a Rego policy evaluates the agent identity, the tool, and the parameter envelope before execution proceeds, and the agent cannot reason or argue past the result.
why it helps Privilege Compromise relies on an agent identity holding more authority than its assigned role warrants. OPA enforces the declared scope of each agent identity at the decision layer, so a compromised identity is bounded to what its policy allows, regardless of what its prompt or memory claims.
In most deployments, agents authenticate to one another with long-lived bearer tokens or shared secrets. If any one of those credentials is stolen, the attacker has persistent, platform-wide access until someone manually rotates it. SPIFFE replaces that model: each workload is issued a short-lived, cryptographically verifiable identity document, and every connection requires both sides to present one. No long-lived secrets traverse the network, and a compromised credential is worthless within its TTL.
why it helps Privilege Compromise relies on a stolen or misconfigured identity persisting long enough to be useful. SPIFFE issues short-lived SVIDs scoped per workload, so a compromised identity expires quickly and cannot be used to reach other workloads in the same deployment.
An agent identity that holds broad write authority is a high-value target: compromising its credential gives an attacker persistent, authenticated access to every system that identity can reach. Multi-factor authentication addresses this by requiring a second factor at credential issuance time, so a stolen token is bounded to its issued lifetime and cannot be silently renewed. For non-human identities the second factor is workload attestation, hardware-bound key material, or certificate-backed proof rather than a phone or one-time code.
why it helps Privilege Compromise relies on an attacker obtaining and holding a valid agent credential long enough to act on it. Step-up attestation at credential issuance binds the credential to a second factor the attacker does not hold, so a stolen secret is valid only for the lifetime of the issuance window it was bound to and cannot be silently renewed without passing attestation again.
An agent that operates across HR, Finance, cloud, and SaaS systems accumulates permissions at each boundary, often without any single team seeing the combined picture. Privilege accumulates silently across those boundaries until a quarterly review finds it, by which point a compromised or misconfigured agent has had weeks of unchecked reach. Cross-system scope auditing prevents that by continuously reconciling the agent's actual entitlements against a declared baseline across every system it touches and raising a ticket the moment drift is detected.
why it helps Privilege Compromise occurs when an agent identity accumulates authority beyond its assigned role, either through misconfiguration or gradual drift across system boundaries. Cross-system audit directly detects that accumulation: it ingests entitlements from every system the agent touches, compares them against the declared baseline, and surfaces any net-new or over-provisioned permission before it can be exercised by a compromised agent.
An AI agent operating with broad authority can propose actions that are irreversible: deleting records, modifying IAM policies, moving funds. A single human reviewer at the approval gate is a single point of failure, one compromised account, one fatigued reviewer, or one successful social-engineering attempt is enough to commit the action. Human dual-control addresses that by requiring two distinct, independent humans to approve before the action commits.
why it helps Compromised-operator escalation is the threat, an attacker who has taken over an admin account, or an insider acting unilaterally, attempts to approve a privilege-escalating action through the HITL gate. Requiring a second, independent human means a single compromised identity cannot unilaterally commit the action; the attacker must also control or deceive the second approver.
An agent running with a permanent high-privilege identity gives an attacker, or a misconfigured agent, broad access for as long as that identity persists. Time-bounded privilege elevation addresses this by issuing a short-lived credential tied to a specific action window: the agent holds elevated access only for the duration it needs, and the issuing platform revokes that access automatically when the TTL expires. This is the just-in-time (JIT) access pattern from PAM practice, applied to non-human identities.
why it helps Privilege Compromise gives an attacker the authority of a compromised agent identity. Time-bounded elevation limits how long that authority is valid: the stolen or manipulated credential expires at its configured TTL, and every subsequent action requires a fresh elevation that can be independently audited or denied.
An agent that holds a persistent catalog of invokable tools can reach any of them at any point in its session. If its reasoning is manipulated or its identity is compromised, that persistent surface is fully available to an attacker. Just-in-time tool grants remove the standing surface: a policy broker issues a time-bound, task-scoped grant immediately before the tool is needed and revokes it automatically when the task completes or the window expires.
why it helps Privilege Compromise relies on a compromised agent identity retaining access to tools beyond those its current task requires. JIT grants ensure that a compromised identity can only reach tools that have been explicitly granted for the running task; the rest of the catalog is structurally inaccessible until a new grant is issued.
A Non-Human Identity (NHI) is the service account, machine principal, or formal agent identity under which an agentic system authenticates and acts. When an NHI is provisioned with broad scope, never rotated, and has no named owner, a stolen or leaked credential gives an attacker persistent access for as long as that credential remains valid. NHI lifecycle management treats each agent identity as a first-class governance object: provision narrowly with a declared scope and owner, rotate on a short schedule using platform-native short-lived credentials, audit every authentication and rotation event, re-attest that the identity is still needed, and decommission by deletion when the agent is retired.
why it helps Privilege Compromise depends on an agent identity retaining elevated access beyond its intended scope or lifetime. Narrow provisioning sets a defined scope ceiling at issuance; aggressive rotation shortens the window within which a compromised credential can be exercised; re-attestation removes scope that accumulated over time. Together they reduce both the authority a stolen credential carries and the duration it remains usable.
An agent's authority is normally bounded only by its own reasoning. If that reasoning is manipulated, or the agent's identity is compromised, it will attempt actions the operator never intended to permit. Policy-bound autonomy addresses this by placing a declarative enforcement point between the agent and every consequential action: a policy engine evaluates the agent identity, the target tool, and the parameter envelope before execution, and the agent cannot reason or argue past the result.
why it helps Privilege Compromise occurs when an agent identity acquires or is induced to exercise authority beyond its assigned role, for example through credential theft, prompt injection, or role confusion. The policy engine evaluates the declared scope of each agent identity on every request, so a compromised identity is bounded to what its policy allows regardless of what the agent's prompt or memory claims.
Role-Based Access Control (RBAC) assigns every agent identity a named role that sets the outer limit on what it can reach. Attribute-Based Access Control (ABAC) narrows individual decisions inside that role by evaluating contextual attributes at request time. Used together, they enforce least privilege for non-human identities: the agent can only do what its role permits, and only when the request attributes satisfy the policy.
why it helps Privilege Compromise occurs when an agent accumulates permissions beyond what any single task requires, giving an attacker a large blast surface if the agent is manipulated or its credentials are stolen. Binding each agent identity to a named role at provisioning time, and further constraining individual tool calls via ABAC conditions, keeps the permissions envelope at task scope rather than system scope.
An agent identity backed by a long-lived bearer token grants access for as long as that token remains valid. If the token is stolen, logged, or extracted from a running process, the attacker holds working credentials for weeks or months without any further action. Short-lived tokens address this by issuing credentials with a time-to-live measured in minutes or hours, automated and renewed by the platform rather than a human. When a token expires, access ends: the attacker must win the renewal process as well, which requires compromising a harder target than the token itself.
why it helps Privilege Compromise occurs when an attacker obtains an agent credential and uses it to exercise authority the legitimate identity holds. Short TTL bounds the exploitation window to the token's remaining lifetime: a stolen credential becomes useless at expiry without a separate compromise of the renewal path.
Each tool in an agent's catalog should expose only the methods, resources, and parameter ranges its designated role requires. Over-broad tool surfaces let individually authorised primitives compose into actions no human intended to grant; narrowing the scope at design time reduces both the attack surface and the blast radius of any compromise.
why it helps Privilege abuse after an agent compromise is bounded by what the agent's token scope permits. Least-privilege scoping ensures a fully compromised agent still holds only the narrowest authority the task required, not the broadest authority it could ever have needed.
The OWASP OWASP MAS Threat Modelling Guide v1.0 catalogues 6 named multi-agent variants of T3, anchored to specific MAESTRO layers. Each is a concrete attack pattern that emerges when this threat compounds across agents.
Manipulating inter-agent negotiation protocols to reshape outcomes / monopolise resources.
Sensitive data leaked during inter-agent exchanges; a concern specific to multi-agent data sharing.
Agent-specific permissions exploited to execute high-privilege actions on a malicious user's behalf.
Sensitive data leaks agent-to-agent via compromised interactions, creating a system-wide privacy issue.
Compromised admin agent exploits legitimate access to create backdoors / modify security settings.
Chained authorization across MAS lets a malicious user execute beyond their granted permissions.
Source: OWASP MAS Threat Modelling Guide v1.0, §2 Overview of MAESTRO Framework — Extended Threat Scenarios + Cross-Layer table.
This normalized catalogue includes 4 multi-agent entries based on the OWASP MAS Threat Modelling Guide v1.0 that extend T3. The source guide reuses some numbers between worked systems; these Helmwart entries provide stable detail pages, MAESTRO layers, and mitigation coverage.
Service account credentials accidentally exposed (e.g. committed to a public repository) grant an attacker direct access to privileged backend systems.
A bug in the dynamic policy engine prevents correct policies from being applied to new contexts, granting users capabilities they should not have.
An MCP server deployed without adequate network controls is reachable from unauthorised networks, exposing all connected resources.
The MCP server runs with excessive operating-system permissions; once compromised, the attacker inherits broad host access.
MITRE ATLAS catalogues adversary techniques against AI systems. Where this OWASP threat has an attacker-perspective counterpart, the ATLAS technique is shown below. That is what a red team would actually be doing on the wire. Use this for detection-signal anchoring, threat-hunting hypotheses, and IR runbooks. Source: mitre-atlas/atlas-data v5.6.0.
© 2026 The MITRE Corporation. ATLAS content is reproduced and distributed with the permission of The MITRE Corporation.
AML.T0012Valid Accountsview on ATLAS ↗Adversary obtains and abuses legitimate user or service credentials for initial access, persistence, privilege escalation, or defence evasion.
Agentic angle: Agents often run under long-lived service accounts whose blast radius exceeds the original task scope.
AML.T0055Unsecured Credentialsview on ATLAS ↗Adversary discovers credentials stored in plain configuration files, environment variables, or model context where they should not be exposed.
Agentic angle: Agent configuration files (system prompts, tool descriptors, MCP manifests) are a fresh credential exposure surface.
AML.T0083Credentials from AI Agent Configurationview on ATLAS ↗Adversary extracts credentials, API keys, or service-account tokens from an agent's configuration files, system prompts, or environment.
AML.T0098AI Agent Tool Credential Harvestingview on ATLAS ↗Adversary uses access to an AI agent to retrieve credentials stored in or accessible through the agent's connected tools: document stores, code repos, productivity platforms.
Agentic angle: Agent tools aggregate credentials from many integrated services; harvesting them grants lateral movement across the victim's entire connected toolchain.
Adapted by Helmwart from the OWASP source(s) above underCC BY-SA 4.0(changes: normalized IDs, added MAESTRO-layer, agentic-factor, and mitigation mappings). This entry is licensed CC BY-SA 4.0.
Press play. The voice downloads once, then it’s cached.
On-device · private