In a multi-agent pipeline, agents often trust messages from other internal agents by default. A compromised or attacker-controlled low-privilege agent can relay valid-looking instructions to a high-privilege agent. The high-privilege agent executes them without re-verifying the original user's authority.

Classic example: a crafted email reaches an email-sorting agent. The email contains instructions to forward funds to a specific account. The sorting agent passes these instructions to a finance agent. The finance agent, trusting an internal agent's message as if it were internally verified, processes the transfer.

The attacker never touched the finance system. They used the email agent as a relay — the confused deputy.

TOCTOU stands for Time-of-Check to Time-of-Use. Permissions are validated at the start of a workflow. Hours pass. The user's authorization changes — a spending limit is reduced, a role is revoked, an approval expires.

The agent doesn't know this. It continues with the original, now-invalid authorization token and completes the workflow. The transaction is logged as authorized. The authorization used was stale.

The gap between when permissions are checked and when they are used is the attack window — and long-running agentic workflows make that window very wide.

An attacker registers a fake agent in an internal agent directory under a trusted-sounding name: "Admin Helper", "IT Maintenance Bot", "HR Assist". The descriptor claims the agent is an authorized internal service with high-privilege capabilities.

Other agents — discovering tools and services through the registry — route privileged maintenance tasks to it based on its name and descriptor alone. No authentication. No verification. The attacker's agent collects those tasks, the credentials that accompany them, and the access they grant.

Trust in agent registries is often implicit. If an agent says it's the "Admin Helper," it gets treated like one.