Identity Spoofing

When agents authenticate to each other and act on behalf of humans, identity becomes attackable. This type covers agents impersonating other agents or users, forged delegation chains, and trust inherited without verification — OWASP ASI03.

OWASP Agentic Top 10: ASI03 Identity and Privilege Abuse

Other agent threat types

Prompt Injection MCP Tool Poisoning Tool Misuse Memory Poisoning Agent Worms Privilege Abuse Unsafe Code Execution Data Exfiltration Protocol Vulnerabilities Framework Vulnerabilities Supply-Chain Compromises Goal Hijacking Identity Spoofing Inter-Agent Communication Cascading Failures Human Trust Exploitation Rogue Agents Resource Exhaustion

Showing 1–2 of 2 threats, newest first

Trigger.dev Google OAuth Account Takeover via Unverified Email

highAgentIdentity Spoofing

oauthaccount-takeoverauthentication-bypassemail-verificationidentity-spoofingtrigger.devagent-platformASI08 · Cascading FailuresSurface: Human InterfacePropagation: Single Hop

Trigger.dev, a platform for managing AI agent workflows, fails to check Google's email_verified flag during OAuth login, allowing an attacker to create a Google account with an email matching an existing victim's account and take it over. Because Trigger.dev orchestrates AI agent deployments, compromising an account gives an attacker control over that user's agents, workflows, secrets, and API keys. This is a classic identity-spoofing/authentication flaw rather than a novel agentic attack, but it has serious downstream impact on agent supply-chain trust.

Updated Aug 14, 2026 · CVSS 7.4

Flowise Hardcoded Default JWT Secrets Authentication Bypass

criticalAgentIdentity Spoofing

flowisejwthardcoded-secretauth-bypassprivilege-escalationagent-frameworkenterprise-authASI01 · Goal HijackingSurface: Human InterfacePropagation: Single Hop

Flowise, a popular low-code AI agent/LLM workflow builder, ships with hardcoded fallback JWT secrets, audience, and issuer values that activate silently when operators fail to set the corresponding environment variables. An attacker who knows these public default values can forge valid JWTs to impersonate any user, including administrators, granting full control over the agent platform and any connected tools, credentials, or workflows.

Updated Jul 13, 2026 · CVSS 9.8