In AG03, the failure is about who the agent is and what it's allowed to do — not about how it uses a specific tool. An agent that issues a refund it shouldn't have is misusing a tool. An agent that inherits admin credentials it was never supposed to have, then creates a new user account — that's identity and privilege abuse.
The distinction: did the agent's access rights expand beyond what it was supposed to have? That's AG03.
In AG03, no credential theft occurs in the traditional sense. The agent already had the credentials, or was handed them through a legitimate delegation chain. The abuse happens through that chain — not by bypassing it from outside.
If credentials were stolen from a database or intercepted in transit, that's a different class of attack entirely. AG03 exploits the delegation and trust system, not the credential storage system.
A chatbot giving bad advice is a problem — but it's a stateless output that a human can evaluate and reject. AG03 is about what the agent does with its access rights: accounts created, transactions processed, data copied, credentials shared. The harm is an action in the world, not a sentence on screen.
AG03 is: the agent's identity or privilege — how it authenticates, what it's allowed to do, whose trust it inherited — was exploited, over-delegated, or retained past its intended scope, and real access was granted that should not have been.