A finance manager agent needs to run a quarterly report. It delegates the task to a specialized "DB query" sub-agent. To make the handoff simple, it passes its full credential context — not just the SELECT permission on the reports table, but its complete access profile: HR records, payroll data, legal documents, contract database.
The sub-agent now has access to everything the finance manager can touch. An attacker who can steer the sub-agent's prompts has inherited the finance manager's privileges.
Scoping delegated permissions requires extra work at design time. You have to know exactly what the sub-agent needs, create a narrowly scoped credential for it, and handle the case where it needs more. Most teams skip this step — "it's just an internal agent, we'll scope it later."
Low-code and no-code agentic platforms make it worse: they often grant broad defaults (unrestricted internet access, full org API access) because that's the path of least resistance for getting something to work quickly.
Every agent in the delegation chain multiplies the potential blast radius. If the orchestrator has admin access and delegates to three sub-agents, each of those three agents is now a potential admin-level attack surface. The attacker only needs to compromise one.
Un-scoped privilege inheritance turns a single high-privilege agent into a threat that scales horizontally across every sub-agent in its chain.
"Occurs when a high-privilege manager delegates tasks without applying least-privilege scoping — often for convenience or due to architectural limits — passing its full access context. A narrow worker then receives excessive rights. Low- or no-code agents with default privileges, such as unrestricted Internet access, also inherit more authority than intended."