OWASP ASI03: Identity and Privilege Abuse - When AI Agents Have Too Much Access

Artificial intelligence is moving beyond generating content and answering questions. AI agents can now access enterprise applications, interact with cloud infrastructure, retrieve sensitive information, execute workflows, and make decisions on behalf of users and organizations.

To perform these tasks, agents need identities, credentials, permissions, and access to business systems.

But what happens when an AI agent has more access than it needs? What if it inherits a user’s administrative privileges, shares credentials across multiple workflows, or is manipulated into performing actions beyond its intended responsibilities?

These scenarios introduce a growing cybersecurity concern: Identity and Privilege Abuse.

Identified as ASI03 in the OWASP Top 10 for Agentic Applications 2026, this risk highlights how weak identity controls, excessive permissions, and poorly governed authorization can turn otherwise legitimate AI agents into pathways for unauthorized access, privilege escalation, and data exposure.

As organizations adopt agentic AI, identity security must extend beyond human users and traditional service accounts to include autonomous and semi-autonomous agents.

What Is ASI03: Identity and Privilege Abuse? When an agent inherits more authority than it should have

How?

• Agents often reuse user or service credentials embedded in context, memory, or tool responses -even when those credentials were not meant to be forwarded.
• Because agents can inherit or delegate credentials across task boundaries and other agents, tokens unintentionally propagate and allow access beyond the original.

Example

• A Developer Copilot holds a high-privilege GitHub token to manage repo settings.
• During a task handoff, the token leaks into a lower-privilege orchestration agent.
• An attacker sends a crafted request to that agent, which—using the inherited token – makes a private repository public or deletes it.
• Impact: A low-privilege agent becomes a confused deputy, performing high-risk GitHub actions through inherited credentials.

Identity & Privilege Abuse exploits dynamic trust and delegation in agents to escalate access and bypass controls by manipulating delegation chains, role inheritance, control flows, and agent context; context includes cached credentials or conversation history across interconnected systems.

ASI03: Identity and Privilege Abuse refers to security risks arising when AI agents misuse, inherit, impersonate, or exceed the identities and privileges assigned to them, potentially performing actions that should not be authorized.

In this context, identity refers both to the agent’s defined persona and to any authentication material that represents it. Agent-to-agent trust or inherited credentials can be exploited to escalate access, hijack privileges, or execute unauthorized actions.

Identity and Privilege Abuse risk arises from the architectural mismatch between user-centric identity systems and agentic design.

Identity & Privilege Abuse is the agentic evolution of Excessive Agency (LLM06:2025). It often leverages Prompt Injection (LLM01:2025), and because of agent permissions, tool integrations, and multi-agent systems, the impact can amplify and exceed Sensitive Information Disclosure (LLM02:2025) to directly compromise the confidentiality, integrity, and availability of systems and data the agent can reach.

Common contributing factors include:

• Excessive privileges: Agents receive broad administrative access instead of narrowly scoped permissions.

• Identity impersonation: Agents operate under a user’s identity without sufficient controls over delegated actions.

• Credential exposure: API keys, access tokens, or service account credentials become accessible through logs, tools, or insecure integrations.

• Privilege escalation: Agents gain access to capabilities beyond their intended authorization.

• Cross-agent trust abuse: One agent improperly relies on another agent’s identity or authorization.

• Missing authorization boundaries: Applications assume that an authenticated agent is automatically authorized to perform a requested action.

Un-scoped Privilege Inheritance

Occurs when a high-privilege manager delegates tasks without applying least-privilege scoping-often for convenience or due to architectural limits-passing its full access context. A narrow worker then receives excessive rights. Low- or no-code agents with default privileges, such as unrestricted Internet access, also inherit more authority than intended.

Microsoft specifically identifies agents using their maker’s authentication as a potential privilege-escalation path.

Cross-Agent Trust Exploitation (Confused Deputy).

In multi-agent systems, agents often trust internal requests by default. A compromised low-privilege agent can relay valid-looking instructions to a high-privilege agent, which executes them without re-checking the original user’s intent misusing its elevated permissions.

Confused deputy problem: a privileged component is induced to misuse its authority on behalf of a less-privileged actor.

Time-of-Check to Time-of-Use (TOCTOU) in Agent Workflows

Permissions may be validated at the start of a workflow but change or expire before execution. The agent continues with outdated authorization, performing actions the user no longer has rights to approve.

Persistent Privileges Beyond the Intended Task

An AI agent temporarily receives elevated access to complete an administrative operation. However, the credentials or authorization remain active after the task has finished. If the agent retains that authority, subsequent requests or compromised workflows could reuse the elevated permissions. This becomes particularly concerning when agents maintain long-running sessions, persistent memory, or reusable credentials.

Example Attack Scenarios

Delegated Privilege Abuse:
A finance agent delegates to a “DB query” agent but passes all its permissions. An attacker steering the query prompts uses the inherited access to exfiltrate HR and legal data.

Cross-Agent Trust Exploitation: A crafted email from IT instructs an email sorting agent to instruct a finance agent to move money to a specific account. The sorter agent forwards it, and the finance agent, trusting an internal agent, processes the fraudulent payment without verification.

Device-code phishing across agents:
An attacker shares a device-code link that a browsing agent follows; a separate “helper” agent completes the code, binding the victim’s tenant to attacker scopes.

Workflow Authorization Drift:
A procurement agent validates approval at the start of a purchase sequence. Hours later, the user’s spending limit is reduced, but the workflow proceeds with the old authorization token, completing the now-unauthorized transaction.

Forged Agent Persona:
An attacker registers a fake “Admin Helper” agent in an internal Agent2Agent registry with a forged agent card. Other agents, trusting the descriptor, route privileged maintenance tasks to it. The attacker-controlled agent then issues system-level commands under assumed internal trust.

Prevention and Mitigation Guidelines

Preventing ASI03 requires organizations to treat AI agents as governed identities with explicit permissions, accountability, and lifecycle controls.

Enforce Least Privilege and Zero Trust

Grant agents only the permissions necessary to complete their assigned tasks. Avoid assigning broad administrative roles simply because an agent may perform multiple workflows.

Apply Zero Trust principles by validating every access request based on identity, resource, context, and risk.

Enforce Task-Scoped, Time-Bound Permissions:
Issue short-lived, narrowly scoped tokens per task and cap rights with permission boundaries – using per-agent identities and short-lived credentials (e.g., mTLS certificates or scoped tokens) – to limit blast radius, block delegated-abuse and maintenance-window attacks, and mitigate un-scoped inheritance, orphaned privileges, and reflection-loop elevation.

Isolate Agent Identities and Contexts:
Run per-session sandboxes with separated permissions and memory, wiping state between tasks to prevent Memory-Based Escalation and reduce Cross-Repository Data Exfiltration.

Mandate Per-Action Authorization:
Re-verify each privileged step with a centralized policy engine that checks external data, stopping Cross-Agent Trust Exploitation and Reflection Loop Elevation.

Apply Human-in-the-Loop for Privilege Escalation:
Require human approval for high-privilege or irreversible actions to provide a safety net that would stop Memory-Based Escalation, Cross-Agent Trust Exploitation, and Maintenance Window attacks.

Bind permissions to subject, resource, purpose, and duration. Require re-authentication on context switch. Prevent privilege inheritance across agents unless the original intent is re-validated. Include automated revocation on idle or anomaly

Detect Delegated and Transitive Permissions:
Monitor when an agent gains new permissions indirectly through delegation chains. Flag cases where a low-privilege agent inherits or is handed higher-privilege scopes during multi-agent workflows.

Monitor Agent Identity and Privileged Activity

Organizations need visibility into what their agents can access and what they actually do. Collect and correlate logs covering authentication, token issuance, authorization decisions, tool invocations, privilege changes, and agent-to-agent delegation.

AI Agents Need Identities, Not Unlimited Authority

The adoption of agentic AI introduces a fundamental shift in enterprise identity and access management. Organizations have traditionally focused on controlling access for employees, contractors, applications, and service accounts. AI agents introduce another category of identity: software entities that can independently plan tasks, interact with systems, and execute actions.

At Reputiva, we believe AI agent security must begin with identity governance, not just prompt protection. An agent may be designed to improve operational efficiency, but its business value should not depend on unrestricted access to enterprise systems.

A poorly governed agent could become a bridge between security boundaries that were never intended to be connected.

We believe organizations should prioritize three questions before deploying agents into production:

1. Who is the agent? Does it have a distinct, governed identity with clear ownership and accountability?

2. What can the agent access? Are its permissions restricted to the resources and operations required for its intended responsibilities?

3. Who authorizes its actions? Are sensitive operations independently validated against the requesting user’s authority and organizational security policies?

Answering these questions requires collaboration across cloud architecture, cybersecurity, IAM, AI governance, and business operations.

The objective is not to eliminate agent autonomy. It is to ensure that autonomy operates within clearly defined and enforceable security boundaries.

Secure Your AI Agents Before They Gain Access to Critical Systems

AI agents are becoming active participants in enterprise workflows. Without proper identity governance, excessive permissions and uncontrolled delegation can introduce serious security risks.

At Reputiva, we help small and medium-sized businesses (SMBs) and enterprise organizations assess and strengthen the security foundations required for responsible AI adoption.

Our advisory services cover cloud security architecture, identity and access management, AI risk and readiness assessments, privileged access controls, and governance across multi-cloud and enterprise environments.

Whether your organization is experimenting with AI assistants, integrating agents into existing applications, or preparing to deploy autonomous workflows, understanding who your agents are and what they can access is an essential first step.

Give AI agents the access they need not, the authority they don’t.

Connect with Reputiva to discuss an AI Readiness Assessment and strengthen the identity, access, and governance controls supporting your AI initiatives.