AG03:2026 — Identity and Privilege Abuse

Slide 15 · Scenarios 3–4

Cross-agent trust exploitation and device-code phishing across agents

Two scenarios that exploit how agents trust each other — and how that trust can be weaponized.

📄 OWASP Top 10 for Agentic Applications 2026 · ASI03 · Example Attack Scenarios

SCENARIO 03

Cross-Agent Trust Exploitation — email agent relays fraudulent payment instruction

An attacker crafts an email that appears to come from "IT Finance" with instructions to transfer funds to a specific account for an "emergency vendor payment." The email is routed to an email-sorting agent that processes incoming messages and forwards action items to relevant agents.

The sorting agent forwards the payment instruction to a finance agent. The finance agent — trusting messages from internal agents as internally verified — processes the payment without re-checking the original sender's authority or verifying the instruction against a human approver.

Why it works: The finance agent's trust model was built for internal-agent-to-internal-agent communication. It had no mechanism to re-verify that the instruction originated from a legitimately authorized source. The email sorting agent was the confused deputy — it faithfully forwarded a malicious instruction as if it were legitimate.

SCENARIO 04

Device-Code Phishing Across Agents

An attacker shares a link containing a device authorization code — the kind used in OAuth device-flow authentication. A browsing agent follows the link as part of processing a message or document. A separate "helper" agent, designed to assist with authentication flows, completes the device code challenge.

The result: the victim's Microsoft or Google tenant is bound to the attacker's application with scopes the victim never consciously granted. The attacker now has persistent access to the victim's organizational resources — through a legitimate OAuth flow completed by agents acting on the victim's behalf.

Why it works: OAuth device-code flows were designed for humans using limited-input devices (TVs, consoles). They don't require the same authentication friction as standard flows. When agents complete these flows on behalf of users, the user has no visibility into what was authorized or what scopes were granted.

← Back Scenarios 5–7 →