AG03:2026 — Identity and Privilege Abuse

Slide 11 · Type 1 — A Real Example

15 Ways to Break Your Copilot — how over-broad delegation became a live attack at Black Hat 2024

Researchers demonstrated that Microsoft Copilot's default privilege scope could be abused through delegation to sub-agents. No credential theft required.

Documented research · BHUSA 2024

Copilot privilege delegation — "15 Ways to Break Your Copilot"

At Black Hat USA 2024, security researchers presented a systematic analysis of privilege abuse in Microsoft Copilot deployments. A key finding: when Copilot delegated tasks to sub-agents or plugins, it often passed its full organizational access context — not a scoped subset.

This meant an attacker who could influence a sub-agent's behavior (through injected instructions in a document, email, or data source the agent processed) could effectively operate with Copilot's full privilege level — including access to files, emails, and internal data the attacker's account had no direct access to.

The agent was the confused deputy. Its broad delegation made it a high-privilege proxy for low-privilege or external attackers.

The lesson: Default privilege scopes in enterprise AI assistants are almost always too broad for safe delegation. Every plugin or sub-agent that receives a delegation is a potential attack surface with inherited enterprise-level access.

CVE · 2025

CVE-2025-31491 — Privilege escalation via agent delegation

A published CVE in 2025 documented a privilege escalation path in an agentic system where task delegation did not enforce scope boundaries. A low-privilege principal could trigger a delegation chain that ultimately executed actions at a higher privilege level than the original requester was authorized for.

This is the textbook Type 1 AG03 pattern — un-scoped inheritance in a delegation chain turning a restricted user into an effective admin through the agent layer.

The lesson: This class of vulnerability is now appearing in CVE databases. It's no longer theoretical — it's being exploited in production systems and formally tracked.

← Back Type 2 — Memory as an attack surface →