The authoritative source for this module. ASI03 definition, five vulnerability types (Un-scoped Privilege Inheritance, Memory-Based Privilege Retention, Cross-Agent Trust Exploitation, TOCTOU Authorization Drift, Synthetic Identity Injection), seven attack scenarios, and nine mitigations are sourced directly from this document.

Presented at Black Hat USA 2024, this research systematically documented privilege abuse paths in Microsoft Copilot deployments, including un-scoped privilege inheritance where Copilot passed broad organizational access context to plugins and sub-agents rather than narrowly scoped delegations. Cited in the OWASP ASI03 references as a key real-world example of Type 1 vulnerability exploitation.

A published CVE documenting a privilege escalation path in an agentic system where task delegation did not enforce scope boundaries. A low-privilege principal could trigger a delegation chain that ultimately executed actions at a higher privilege level than the original requester was authorized for. Demonstrates that un-scoped privilege inheritance is now being formally tracked and assigned CVEs.

Documents real-world cases of prompt injection attacks against MCP-connected agents, including scenarios where injected instructions caused agents to relay commands across agent boundaries — illustrating the cross-agent trust exploitation (confused deputy) pattern covered in Scenario 03.

The original description of the confused deputy problem: a high-privilege program (the "deputy") is tricked by a less-privileged program into misusing its authority. This foundational concept directly maps to AG03's cross-agent trust exploitation vulnerability type, where a high-privilege agent is manipulated by a lower-privilege or compromised agent to perform unauthorized actions.

Overview of cybersecurity considerations specific to agentic AI systems, including identity management challenges and the architectural mismatch between user-centric IAM and agentic deployment models. Provides context for why the attribution gap exists and why it's difficult to close with existing tooling.

Platform-level identity management solutions that treat agents as managed non-human identities. Referenced in OWASP ASI03 MIT 06 as examples of identity platforms that provide scoped credentials, audit trails, and lifecycle controls for agentic deployments.

This module is an independent educational resource. It is not affiliated with, endorsed by, or sponsored by OWASP or any of the organizations whose research is cited above. All trademarks and product names are the property of their respective owners. Real incident descriptions are based on publicly available security research disclosures and may not reflect the full technical details of the original findings.