OWASP Agentic Top 10 · ASI03

Identity and Privilege Abuse

Agents impersonate, inherit, or escalate identity.

What it is

Agents authenticate to services, act on behalf of humans, and delegate to other agents. Identity and privilege abuse covers attacks on that chain: agents impersonating other agents or users, over-scoped credentials inherited from operators, forged or unverified delegation, and the confused-deputy problem where an agent's authority is borrowed for someone else's request.

How it shows up

An agent runs with its operator's full cloud role and is tricked into using it against another tenant. A malicious agent in a multi-agent system claims to be the orchestrator. A delegated token intended for one task is replayed for another.

How to defend against it

Give agents their own least-privilege identities instead of human credentials, bind tokens to task scope and lifetime, verify delegation chains cryptographically, and audit which identity performed each action.

Related threat types: Identity Spoofing, Privilege Abuse

Threats currently tracked under ASI03

Showing 1–3 of 3 threats, newest first

Meta Ads MCP Server Missing Authentication with Access Token Leakage

criticalAgentProtocol Vulnerability
MCPauthentication-bypasscredential-leakmeta-adsaccess-token-exposurestreamable-httpjson-rpcASI03 · Identity SpoofingSurface: Tool LayerPropagation: Single Hop

The Meta Ads MCP server (prior to v1.0.109) fails to enforce authentication on Streamable HTTP requests, allowing any network-reachable caller to invoke privileged Meta Ads tool handlers. When these calls fail downstream, the server leaks the operator's Meta access token by embedding it in the raw request URL returned within the JSON-RPC error response, giving attackers full account takeover potential.

Updated Aug 8, 2026 · CVSS 9.1

IBM Langflow Broken Access Control on Build Job/Log Endpoints

highAgentFramework Vulnerability
langflowbroken-access-controlidorunauthenticated-endpointbuild-jobsagent-frameworkASI03 · Identity SpoofingSurface: Tool LayerPropagation: None

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper access control flaw that lets authenticated users view and manipulate other users' agent flow build jobs and logs, and exposes some build endpoints without authentication at all. This is a genuine vulnerability with a moderate-high CVSS score (7.1), primarily impacting confidentiality and integrity of multi-tenant Langflow deployments rather than enabling remote code execution directly.

Updated Jul 30, 2026 · CVSS 7.1

Adversarial Image Indirect Prompt Injection Leading to Claude Memory Tool Hijack

highAgentMemory Poisoning
prompt-injectionadversarial-imagecross-model-attackmemory-toolindirect-injectionclaudechatgptmultimodalASI03 · Identity SpoofingAML.T0051AML.T0054Surface: MemoryPropagation: Single Hop

A researcher demonstrated that an image generated by ChatGPT could act as a carrier for an indirect prompt injection that hijacked Claude Opus 4.7's memory tool, causing it to persist false memories into future conversations. This shows that even hardened, reasoning-heavy models remain vulnerable to multimodal adversarial inputs crafted using puzzle-like framing to bypass safety reasoning.

Updated Jul 5, 2026