.svg)
What is OWASP ASI03 Identity and Privilege Abuse?
Identity and privilege abuse exploits how agents trust each other: cached tokens, role inheritance, and delegated sessions let one compromised step act with another agent's authority - the confused deputy problem at scale.
What this looks like in production
Healthcare transcription agents joining meetings via stale calendar invites show how context and credentials drift when agents operate on behalf of users.
What teams usually do about it
- Issue scoped credentials per agent and re-auth at delegation boundaries.
- Audit inherited privileges in multi-agent flows.
