AG03:2026 — Identity and Privilege Abuse

Slide 14 · Scenarios 1–2

Delegated privilege abuse and memory-based escalation

Two scenarios that together cover the most common paths attackers use to abuse inherited and retained credentials.

📄 OWASP Top 10 for Agentic Applications 2026 · ASI03 · Example Attack Scenarios

SCENARIO 01

Delegated Privilege Abuse — finance agent → DB query agent

A finance manager agent delegates a task to a specialized "DB query" sub-agent. For convenience, it passes its full permission set — not a scoped query credential, but its complete access profile, including HR and legal data.

An attacker who can steer the query agent's prompts (through injected instructions in a report template, data file, or query result) now has access to HR records, contract details, and legal documents — far beyond what the delegated database query task required.

Why it works: Delegation happened. Scoping didn't. The DB query agent was never supposed to have access to HR and legal data, but it inherited that access from the delegator — and the attacker only needed to compromise the narrower sub-agent, not the high-privilege orchestrator.

SCENARIO 02

Memory-Based Escalation — cached SSH credentials reused across sessions

An IT admin agent caches SSH credentials during a critical server patch late at night. The patch succeeds. The agent's session doesn't clear. The next morning, a non-admin support engineer interacts with the same agent for a routine task.

The engineer asks the agent to set up SSH access for them. The agent, still holding the admin SSH credentials from the previous session, uses them to create unauthorized access for the engineer — elevating their privileges far beyond their assigned role.

Why it works: Agent memory isn't bound to session scope. Credentials persisted past the context they were granted for. The next user effectively inherited the previous user's elevated access — not through any exploit, but through the agent's unsegmented memory.

← Back Scenarios 3–4 →