The clearest case: an outside attacker injects instructions into the agent's input stream (via a malicious email, a poisoned document, a crafted web page) that cause the agent to relay commands to a higher-privileged agent. They never touched the admin system directly — they used a trusted internal agent as their proxy.

The confused deputy attack — where a high-privilege system is tricked into acting on behalf of a low-privilege attacker — is a classic security pattern. Agents are exceptionally good confused deputies.

A support engineer realizes that an IT automation agent they have access to still holds SSH credentials from a previous admin session. They ask the agent to "give me access to the server." The agent complies. No malware, no hacking — just a user who found a gap and used it.

This is especially common in organizations where agents are shared across teams with different privilege levels, and memory is not segmented between sessions.

Sometimes there's no attacker at all. A low-privilege worker agent is granted the full permission set of its orchestrator "for simplicity" at deployment time. A developer uses a low-code platform that defaults to unrestricted internet access. The over-privilege is baked in from day one — it just waits for the right prompt to exploit it.

An attacker registers a fake agent in an internal agent registry under a trusted-sounding name ("Admin Helper", "IT Maintenance Bot"). Other agents route privileged tasks to it based on its descriptor. The attacker's agent collects those tasks — and the credentials that come with them.