PART 2
How It Works
Slides 9–13 · The five ways identity and privilege get abused in practice
Slide 9 · Five Vulnerability Types
AG03 isn't one attack — it's five distinct failure modes
Each one exploits a different property of how agents handle identity and privilege. We'll cover each in depth over the next four slides.
📄 OWASP Top 10 for Agentic Applications 2026 · ASI03
⬇️
Type 1 — Un-scoped Privilege Inheritance
A high-privilege agent delegates a task to a lower-level agent but passes its full permission set instead of a scoped subset. The worker inherits access it was never meant to have. Slides 10–11.
🧠
Type 2 — Memory-Based Privilege Retention
An agent caches credentials during a high-privilege session. In a later session — for a different user or task — those credentials are still accessible. Memory is the unexpected persistence layer. Slide 12.
🔄
Type 3 — Cross-Agent Trust Exploitation (Confused Deputy)
Agents in multi-agent systems often trust internal messages by default. A compromised low-privilege agent relays commands to a high-privilege agent, which executes them without re-checking authority. Slide 13.
⏱️
Type 4 — TOCTOU: Authorization Drift
Permissions are checked at workflow start, then change before the workflow completes. The agent proceeds with outdated authorization, completing actions the user no longer has the right to approve. Slide 13.
🎭
Type 5 — Synthetic Identity Injection
An attacker registers a fake agent with a trusted-sounding name in an internal registry. Other agents route privileged tasks to it based on its descriptor. The attacker's agent collects those tasks and the privileges that come with them. Slide 13.