Slide 7 of 28
Part 1 — What Is It?Slide 7
Slide 7 · What This Is — And What It Isn't
Three things people assume caused the breach. None of them are AG03.
Getting the definition tight matters — because the defense depends on knowing what actually went wrong.
It's not about an agent using an existing tool the wrong way

In AG03, the failure is about who the agent is and what it's allowed to do — not about how it uses a specific tool. An agent that issues a refund it shouldn't have is misusing a tool. An agent that inherits admin credentials it was never supposed to have, then creates a new user account — that's identity and privilege abuse.

The distinction: did the agent's access rights expand beyond what it was supposed to have? That's AG03.

It's not about an attacker stealing passwords or breaking encryption

In AG03, no credential theft occurs in the traditional sense. The agent already had the credentials, or was handed them through a legitimate delegation chain. The abuse happens through that chain — not by bypassing it from outside.

If credentials were stolen from a database or intercepted in transit, that's a different class of attack entirely. AG03 exploits the delegation and trust system, not the credential storage system.

It's not about an agent saying something wrong

A chatbot giving bad advice is a problem — but it's a stateless output that a human can evaluate and reject. AG03 is about what the agent does with its access rights: accounts created, transactions processed, data copied, credentials shared. The harm is an action in the world, not a sentence on screen.

The one-sentence boundary

AG03 is: the agent's identity or privilege — how it authenticates, what it's allowed to do, whose trust it inherited — was exploited, over-delegated, or retained past its intended scope, and real access was granted that should not have been.

← Back Why is agent identity so much harder to secure? →