Red-team lab / Failure patterns
The agent holds more access than its task needs
Agents are often given a shared service account or the developer's own keys because it is quicker. Whatever the agent is then tricked into, or gets wrong, reaches everything that identity can reach.
Design it out
Give the agent the access the task needs and no more: the user's own scoped token, or its own identity, scoped to this task.
- User-scoped access Tools act with the signed-in user's own permissions, never a shared service account.
- Least-privilege tools Each tool does one narrow thing, with only the scopes the task needs.
- Per-tool scoped permissions Each tool gets only the access its job needs, granted separately from the agent's other tools.
- Per-agent capability tokens Each agent holds narrow, short-lived permissions for its own job only.
The agent design check flags it as: It acts with more access than its task needs
.
Practise it
Where it happened
- The support ticket that read the tokens tableGive agents read-only, project-scoped access, and never a role that bypasses the database's own permission checks.
- The agent that deleted productionSeparate environments, and require a human before anything destructive. An instruction in the prompt is not a control.
- A wiper prompt in a coding-agent releaseThe agent's own prompts and extensions are supply chain: review changes to them like code that can delete things, because it can.
- A public issue reads the private reposOne broad token across public and private data is the problem, not the server code: scope the agent to one repository per task.
- 38TB behind one sharing linkAI pipelines move a lot of data around: scope every token to the exact data it is meant to share, and give it a short life.
Risk codes
- LLM02 Sensitive information disclosure
- ASI03 Identity and privilege abuse
- LLM03 Excessive agency
- LLM01 Prompt injection
- LLM04 Supply chain
MITRE ATLAS AML.T0024AML.T0136AML.T0077AML.T0098AML.T0083AML.T0053AML.T0086AML.T0101
OWASP Top 10 for LLM and Agentic Applications (2026) and MITRE ATLAS 2026.10, as mapped on By OWASP risk. My own mapping, not endorsed by OWASP or MITRE.
Built with Llama