Agent identity and privilege abuse

Check method

Looks for shared keys, over-broad tokens and agents acting with a user's identity.

Possible evidence type

Code or configuration review, without exploiting the risk.

Access and limitations

Connected repository. Actual results and checks not run appear in your report. A check with no finding does not guarantee the absence of risk.

Concrete scenario

A background agent reuses an administrator credential for ordinary user tasks.

What to inspect

Trace how the requesting user’s authority is carried into tool calls and later background work.

Remediation approach

Bind actions to the initiating identity and use scoped short-lived credentials where supported.

Model the agent’s actual authority

An agent combines a model with tools, credentials and state. Its risk depends on what those tools can actually do, not on the name of the model. A read-only search tool and a tool that deploys code or transfers funds need different controls. Indirect instructions from a page or another agent must not acquire the authority of the user.

1. Inventory tools, credentials, accessible data and external destinations.
2. Identify approval boundaries for writes, deployments, messages and payments.
3. Check that tool permissions are enforced independently of the model response.

Contain failure and verify boundaries

Use least privilege, isolated execution, bounded iterations and auditable actions. A limit in one tool is ineffective if an alternate tool can perform the same operation without it. Verification should demonstrate blocked misuse and continued normal operation; destructive production exercises need separate owner approval.

1. Use scoped credentials per tool rather than a shared administrator credential.
2. Set run and tool limits and stop on unexpected permission failures.
3. Review the full chain from incoming content to the final external action.

References

OWASP ASI03