AI Agent Privilege Escalation Scenarios
Start here: non-human identities now outnumber human identities by more than 80 to 1 in enterprise environments, per the 2025 Identity Threat Landscape Report, yet 88% of organizations still define only human identities as privileged users. The monitoring apparatus is pointed at the wrong population. Meanwhile, a 2025 BeyondTrust survey of more than 900 practitioners found 74% report deploying agents with more access than their workloads actually require, and only 11% have implemented any governance framework for AI agents at all.
The operational pattern driving this is straightforward and, frankly, lazy: IAM roles get reused across multiple agent deployments rather than scoped per agent per workload. Permissions stack across the third and fourth agent assigned to the same role. In multi-agent architectures, an orchestration agent routinely holds credentials for five or more downstream agents simultaneously, meaning one compromised identity functions as a skeleton key for the entire system.
The governance gap is conceptual before it is technical. Agents are being deployed under the same identity model designed for background jobs, which are predictable, non-autonomous processes executing one task on a schedule. Agents are not that. They interpret ambiguous instructions, select among available tools, and act on those selections at machine speed. Think of a background job as a train on a fixed track — it goes where the rails send it, every time, without deviation. An agent is more like a taxi driver with a city-wide map and no dispatcher: it decides the route. A human analyst with read access to every file in a SharePoint environment is slow; an agent with identical access operates at machine speed. That asymmetry exists before any attacker shows up, because the people provisioning these systems haven't fully reckoned with what an agent actually is versus what a scheduled job was.
Indirect prompt injection: how external content hijacks an agent's actions
Traditional software enforces a hard boundary between executable code and data, at the processor level. An LLM-based agent has no such boundary. Everything in its context window, including content retrieved from the outside world during normal operation, is interpreted as instruction. That is not a bug; it is the architecture. And it means an attacker who can place text in front of an agent can direct its behavior, without ever touching the agent directly.
The delivery mechanism is indirect prompt injection: malicious instructions embedded inside content the agent retrieves during routine operation. A document. An email. A webpage. A RAG corpus entry. The attacker plants something somewhere the agent will eventually look, then waits. It is less like picking a lock and more like leaving a note on someone's desk that reads, "Your boss called — forward him everything."
A Black Hat 2024 demonstration made the basic mechanic viscerally concrete. A user connected ChatGPT to Google Drive and Gmail, then asked for a document summary. Hidden on page 17 of an attached PDF, rendered invisible to human readers, was an instruction to search Drive for API keys and email them to an external address. The agent complied. Nobody's firewall noticed, because there was nothing for the firewall to notice.
The 2025 EchoLeak vulnerability (CVE-2025-32711, CVSS 9.3) in Microsoft 365 Copilot is where this mechanic crossed from proof-of-concept into documented production exploitation. A single crafted email, requiring no user interaction, caused Copilot to access internal files and exfiltrate them to an attacker-controlled server. The bypass chain was elaborate: it evaded Microsoft's prompt injection classifier, circumvented link redaction via reference-style Markdown, exploited auto-fetched images, and abused a Teams proxy already permitted under the existing content security policy. Everything in Copilot's scope, SharePoint, OneDrive, Teams messages, chat logs, preloaded organizational data, was within reach. The operation executed entirely in natural language space. Antivirus, firewalls, and static file scanning are categorically blind to it. Microsoft patched the specific vulnerability server-side and confirmed no exploitation in the wild.
Here is the uncomfortable structural point that patch obscures: indirect prompt injection is not a bug in Copilot. It is a property of how any RAG-based assistant works. Any system that retrieves and processes external content on a user's behalf carries this surface. The specific bypass chain changes; the exposure does not.
A GitHub repository tracking AI security incidents, curated through April 2025, documented 520 tool misuse and privilege escalation incidents in AI systems; 450 involved prompt injection. It is the dominant vector by a wide margin, and that margin is likely to widen as agent deployments scale.
Semantic privilege escalation: authorized access used in ways that violate intent
This scenario produces no CVE, no failed permission check, no stolen credential. The agent does exactly what it is permitted to do. That is precisely the problem.
A 2024 case from financial services, documented by Stellar Cyber, is the clearest available illustration. An attacker phrased a request to a reconciliation agent as a routine business task: export all customer records matching a specified pattern. The pattern was a regular expression that matched every record in the dataset. The agent complied. Forty-five thousand customer records left the environment through a legitimate export operation that passed every permission check and generated an audit log entry indistinguishable from normal workflow.
The agent's susceptibility is architectural, not incidental. LLM-based agents are optimized for task completion; they lack the contextual judgment a human employee applies when a request feels disproportionate or the rationale doesn't fit the ask. An experienced employee handed that same request would probably send a Slack message asking if someone really meant to pull the entire database. An agent receives an instruction, confirms it has access, and executes. The absence of that friction is a design goal that doubles as a security liability, and the tradeoff rarely receives the acknowledgment it deserves.
The forensic problem is equally significant. A conventional unauthorized-access event leaves evidence of circumvention; semantic escalation leaves a clean audit trail showing an authorized principal performed an authorized action. Attribution requires reconstructing intent rather than permissions — a harder investigative problem with fewer tools built to support it.
The connection to over-permissioning is direct. Semantic escalation operates at whatever scale the agent's access permits. Narrow, task-scoped permissions limit the damage; broadly inherited permissions transform a single cleverly phrased request into catastrophic data exposure. Access models designed around whether an agent can do something, rather than whether it should do it in a given context, are structurally unequipped to prevent this class of event.
Tool chaining and multi-agent trust: how a low-privilege compromise becomes a high-privilege one
Multi-agent systems assign different privilege levels by design. Worker agents handle narrow, bounded tasks; orchestrator agents coordinate across workers and hold broader access. The problem is trust: orchestrators trust messages from worker agents because they are part of the same system. That assumption of internal legitimacy is what attackers exploit. OWASP's Agentic Top 10 names this "agent injection through communication channels," and it is not hypothetical.
In September 2025, researcher Johann Rehberger documented a reciprocal escalation loop between GitHub Copilot and Claude Code. A hijacked Copilot instance wrote malicious instructions into Claude Code's configuration files, specifically its MCP server configuration and persistent instruction file. When Claude Code started, it loaded the poisoned configuration, connected to an attacker-controlled MCP server, and then poisoned Copilot's settings in return. The loop sustained itself. Neither agent raised a flag, because neither agent had a mechanism to distinguish "instructions from the system" from "instructions that happen to be inside the system." You can call it a trust fall — except both agents hit the floor.
The persistence mechanic is what makes this durable. Those configuration files load at every session start; an instruction written once executes again on every subsequent session without any additional attacker action. You can patch the product and still be running the malicious instruction. A single configuration-file write becomes a backdoor that survives session resets, agent restarts, and routine maintenance cycles.
Tool chaining amplifies the blast radius at each step. Every call in a chain can carry the agent's full permission set: read a file, write an API call, spawn a subprocess, faster than any human review cycle can intervene. The supply chain dimension compounds this further. A malicious MCP package documented in April 2025, the postmark-mcp package, silently BCC'd every message processed by the affected agent to an attacker-controlled address across more than 1,600 downloads before removal, per BeyondTrust's research. A poisoned tool in a chain is functionally equivalent to a compromised node. The chain does not know the difference, and there is currently no reliable mechanism forcing it to find out.
Cloud platform service-account escalation: when the infrastructure itself over-provisions agents
In November 2024, Unit 42 researchers published research documenting two privilege escalation paths in Google's Vertex AI platform. The first: the AI Platform Custom Code Service Agent held permissions to list all service accounts and create, delete, read, and write all storage buckets in the project. The second: a malicious model deployment could access all fine-tuned models stored in the project's Cloud Storage. Neither path required a novel exploit. Both relied on querying the standard cloud metadata service to harvest pre-existing, over-scoped credentials available to any code executing in the agent runtime.
Unit 42 documented that a principal holding only the single permission to create custom AI platform jobs can run code as Google's managed Custom Code Service Agent, retrieve a cloud platform token from the metadata service, and use that token to mint tokens for any service account in the project. A low-privilege ML role becomes project Editor, with no additional authentication requirement and no user interaction required. Google's Cloud Vulnerability Reward Program marked the issue "Won't Fix (Infeasible)," which is a memorable way to document a known escalation path and then leave it open.
Unit 42's characterization is precise: a misconfigured or compromised agent becomes a "double agent," appearing to serve its intended purpose while exfiltrating data, compromising infrastructure, and establishing persistence. The specific Vertex AI finding is less important than the pattern it represents. Cloud AI platforms provisioning broad default service accounts for agent execution contexts is a vulnerability class, not a single correctable bug. It applies wherever AI service agents inherit platform-level credentials without least-privilege scoping, and that covers a great deal of currently deployed infrastructure.
Persistent memory and context poisoning as a long-term escalation vector
Long-running agents with persistent memory, whether implemented through vector stores, conversation history, or external memory backends, carry state across sessions; any corruption of that state persists with it. This is the slowest escalation path in this piece, and for that reason the hardest to detect.
The chain follows a recognizable structure: prompt injection installs the payload; context manipulation bypasses safety constraints; the payload corrupts long-term memory; the attack survives session resets and spreads laterally to other users, devices, connected services, or adjacent agents. The malicious instruction executing in session fourteen was written in session two. That causal distance is the point. It frustrates forensic investigation in ways most incident response processes were never designed to handle, because they assume temporal proximity between cause and observable effect.
Sysdig documented what they characterized as the first extortion operation run entirely by an autonomous LLM agent: reconnaissance, credential theft, lateral movement, privilege escalation, and persistence executed end-to-end, culminating in the encryption of more than 1,300 Nacos service-configuration items before the originals were deleted. The persistence mechanisms documented in multi-agent cases, specifically configuration files loaded at startup, are the infrastructure-layer equivalent of memory poisoning; the agent's operating environment is corrupted rather than its in-context state, and the corruption reloads on every subsequent session.
IBM's 2025 Cost of a Data Breach Report puts shadow AI-related breaches at an average of $4.63 million, roughly $670,000 more than a standard breach. The reason is unsurprising: compromised agents reach across many connected systems simultaneously. Persistent escalation compounds this by stretching the exposure window from hours into weeks or months, significantly increasing remediation cost.
What these scenarios share: the detection gap they collectively create
The unifying characteristic across every scenario in this piece is that none of them reliably produce a CVE. A GitHub repository tracking AI security incidents noted a widening gap between traditional CVE-based vulnerability management and architectural AI risks that never receive CVE identifiers, because they are not, strictly speaking, bugs. They are features operating outside their intended context. The vulnerability-management apparatus was never built for that category, and the seams are showing.
Each scenario defeats a different conventional detection mechanism. EchoLeak executes in natural language space, invisible to antivirus and static file scanning. Semantic escalation produces a legitimate audit entry; forensics becomes an exercise in inferring intent rather than identifying circumvention. Memory poisoning separates cause from effect across time. Tool chaining moves faster than human review cycles. Cloud service-account escalation uses standard platform APIs. No anomalous traffic signature. No failed authentication event. No unexpected process execution. The signals most security tools are calibrated to detect simply do not appear, because these are not the kinds of things those tools were designed to look for.
A 2025 Dark Reading survey found 48% of security professionals named agentic AI the top attack vector; a Darktrace survey found 92% of respondents expressing concern about AI agents. Awareness is not the gap. Tooling coverage is. Most monitoring infrastructure is still oriented toward human identities and the behavioral patterns humans exhibit: credential stuffing, unusual login times, geographic anomalies. Non-human identities operating at machine speed through legitimate permission sets produce none of those signals.
Closing that gap requires specific things: discovery of every agent running in the environment, because you cannot monitor what you haven't inventoried; real-time monitoring of agent-initiated traffic, because the window for prevention is before execution; behavioral baselines that flag deviation from expected tool-use patterns, because the action itself looks legitimate even when the surrounding context makes it anomalous; and enforceable policy controls that can stop an action before it completes, not audit logs reviewed after the damage is confirmed.
These are not red-team thought experiments. They are production events spanning financial services, cloud infrastructure, and enterprise productivity software. The escalation paths are documented, repeatable, and in several cases vendor-confirmed. Whether your security team can currently see an agent traversing one of them is a question worth asking before the answer becomes obvious.
