Risk · R-051 · Agentic & Autonomous Systems
Agent identity and privilege abuse
An agent inherits, shares or escalates credentials and delegated authority beyond what its task needs, so a compromise or error acts with far wider access than intended.
- Severity
- High
- Audience
- Heads-of · Practitioner
- Frameworks
- AML.M0026 · AML.T0098 · ASI03
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
Identity systems were built for people and for fixed workloads. An agent is neither: it acts for different users at different times and may delegate to other agents. Without an identity of its own, it runs as whoever configured it, or as a shared account, and the link between an action and the person it was done for is lost. This entry covers who the agent is and what it may reach. What it does with a tool it may properly use is agent tool misuse.
How it happens
- The agent runs under a developer's or an administrator's credentials.
- One identity serves every user, so the agent can retrieve for one user what only another may see.
- Credentials cached in context or memory are reused in a later, unrelated task.
- A sub-agent receives the full authority of the agent that called it.
Why it matters
Access control is the organisation's main protection for data and for the ability to transact. An agent that sits outside it, or above it, removes that protection for everything the agent can reach, and makes the audit trail name the wrong actor.
Warning signs
- Agents do not appear in the identity inventory.
- Agent credentials are long-lived or shared between agents.
- Access logs show a human's account active at times the person was not.
- Entitlement reviews do not cover agents.
Who owns it
The identity and access management function owns the standard. The agent's owner is accountable for what it is entitled to, as for any member of staff.
In practice
A research agent is given a senior analyst's token so that it can read restricted reports. A junior colleague asks it a question and receives an answer drawn from material they are not cleared to see. The same pattern generalises to any agent serving several users under one identity.
Mitigating controls
Primary controls
- Least-privilege agent identity and permissions Preventive
- Gives each agent its own identity with short-lived, task-scoped permissions. Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement.
Supporting controls
- Agent action tracing Detective
- Attributes every action to an identity. Every agent action is recorded with the instruction, plan, tool call, result and identity that produced it, in a form that allows the sequence to be reconstructed.
- Model and data access control Preventive
- Applies role-based access to what agents can reach. Access to model weights, training data, pipelines and inference endpoints is granted by role, limited to need, logged and reviewed.
- Secrets management for AI Preventive
- Keeps credentials out of the agent's readable context. Credentials used by AI systems are held in a vault, supplied at run time, kept out of prompts, configuration and notebooks, scoped narrowly and rotated.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| MITRE ATLAS | AML.M0026 | Manage AI Agent Service Access Privileged agent permissions. |
| MITRE ATLAS | AML.T0098 | AI Agent Tool Credential Harvesting Harvesting of tool credentials. |
| OWASP Top 10 for Agentic Applications | ASI03 | Identity and Privilege Abuse The entry this risk is named for. |
Sources
- MITRE ATLAS MITRE · framework
Related terms
How to cite
Axiom Verity (2026). Agent identity and privilege abuse. Reference Library, R-051. https://axiom-verity.com/risks/agent-identity-and-privilege-abuse. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.