A finance agent processes payments it was never authorized to make — because it trusted a message from another internal agent that was compromised or forged. The authorization chain looked valid. The money left.

An agent caches credentials during a high-privilege task. A later, lower-privilege user in the same session prompts the agent to reuse them — giving that user access they were never supposed to have. No password was stolen. The agent handed it over.

A sub-agent inherits the full permissions of its orchestrator instead of a narrowly scoped subset. An attacker who can steer the sub-agent can now access HR records, legal files, and financial data — far beyond what the original task required.

An agent with admin credentials is tricked into creating new user accounts with elevated privileges. No attacker touched the admin console directly. They just prompted the agent.

A forged "Admin Helper" agent registers itself in an internal agent registry. Other agents route privileged maintenance tasks to it. The attacker's agent issues system-level commands under assumed internal trust.

An agent validates a user's spending limit at the start of a workflow. Hours later the limit is reduced, but the agent completes the purchase using the old, now-invalid authorization. The transaction is both logged and wrong.