Session Fixation and Hijacking Risks in Multi-Step Agent Workflows

Session fixation and hijacking in multi-step agent workflows are not simply web-session risks with a faster operator. Persistent credentials, chained tools, and shared memory can turn one compromise into a cascading breach. Security must be enforced outside the agent, across actions, delegation chains, and session boundaries.

Why agent sessions are structurally different from human sessions

A human logs in, completes a task, and leaves. An agent may keep working for days or longer, keeping its credentials as it works through a multi-step plan. The inherited session model assumes short credential lifetimes, bounded scope, and someone who eventually logs out. Agents break that rhythm by design. Applying the same model to them leaves the security boundary tied to a unit of work that no longer describes the work.

The difference goes beyond how long the connection stays open. Traditional LLMs operate in a text sandbox, while agentic systems use tools, retain long-term memory, and execute plans. A compromised agent can therefore become an active participant in enterprise infrastructure, executing code, modifying databases, and invoking APIs without direct human oversight. The consequences are no longer confined to text. Nor can pattern-based detection built around human behavior reliably track how an autonomous operator decides what to do.

How long-lived credentials turn token lifetime into blast radius

Credential lifetime is the first concrete consequence of that mismatch. Production agent deployments, including documented MCP deployments, have used long-lived tokens that are difficult to revoke. A stolen credential that remains valid for days or months creates an impersonation opportunity for that duration. Historically, MCP lacked credential revocation on session close, consent gates for sensitive tools, and mandatory audit trails, leaving important gaps between ending a session and ending its authority.

A2A leaves another part of this boundary to implementors. The protocol does not set credential scope, representation, validity, or revocation semantics, so it supplies no minimum restriction on token lifetime or privilege scope. Coarse-grained tokens can consequently give an agent more authority than any single task needs. Interception transfers that authority to the attacker. Token lifetime sets how long the attacker has to act, while token scope sets what the attacker can do.

MCP’s authorization hardening, shipped on 28 July 2026, addresses part of this problem through iss validation, DCR deprecation, and credential binding. The revision also retains the existing prohibition on token passthrough. The Cloud Security Alliance’s MCP Security Best Practices recommends access token lifetimes of no more than one hour and refresh token rotation on each use as a Level 2 maturity requirement. At that level, it also prohibits storing session tokens in plaintext files or environment variables, while advising against that storage at the requirements level.

The IETF draft draft-oauth-ai-agents-on-behalf-of-user approaches the gap through agent-specific delegation. First published in May 2025 and expired in February 2026, it adds actor-specific fields, specifically requested_actor, to the authorization request. Its status is important. It remains a draft proposal, but it recognizes that existing OAuth arrangements were not built for agentic delegation. Better credential handling narrows the opening without resolving what happens once an agent starts acting through it.

What cascading tool calls do to the blast radius of a single hijacked token

A multi-step agent can pursue a hijacked goal across tool invocations without being prompted again. That changes the unit of damage. Rather than enabling one unauthorized action, a compromised token can expose an execution chain across the tools its permissions allow. Each call may look legitimate on its own because the malicious purpose lies in how the calls fit together. Excessive agency widens that chain by giving the attacker permissions unrelated to the step currently in progress.

Security researchers demonstrated this pattern in the Cursor/Supabase case in June 2025. They connected the coding agent to a database with broad privileges and placed a prompt injection in a support ticket. The agent then read the private tables and leaked the integration tokens through that same support channel.

JAW framework research found 4,174 hijackable GitHub workflows and eight hijackable n8n templates across 15 widely used GitHub Actions and two official n8n nodes. Its findings included official actions for Claude Code, Gemini CLI, Qwen CLI, and Cursor CLI. The research demonstrated practical paths to credential exfiltration and arbitrary command execution through workflow hijacking. In a multi-agent workflow, that same cascading logic extends beyond tools, because a hijacked agent can pass malicious instructions to downstream agents that trust it.

Agent Session Smuggling and loopjacking: how session state becomes an attack channel between agents

When agents use stateful protocols to communicate, the session state they share gives an attacker another way to steer the workflow. Agent Session Smuggling injects covert multi-turn instructions through an active cross-agent session, using its legitimate communication channel. It can change what an agent attempts without human approval. No separate intrusion channel is required. The exchange that lets agents cooperate also gives malicious instructions a route between them without defeating each agent’s defenses separately.

Loopjacking attacks a related but distinct boundary, the binding between human approval and the operation that follows. A person may approve one operation while the implementation uses that decision for a materially different one, including through post-approval state substitution. The checkpoint itself need not be defeated. Smuggling and loopjacking can therefore compose, with covert instructions shaping the exchange and substituted state changing what an approval releases. A human-in-the-loop label is not a guarantee that the approved operation remains the executed operation.

Delegation makes attribution harder as well as authorization. OAuth authenticates the final hop in a multi-hop chain but provides no record of the authorization chain that led there. An intermediate agent’s malicious instructions can thus arrive authenticated without being traceable to their origin. Identity alone does not establish the instruction’s authority. The OWASP Top 10 for Agentic Applications, published in December 2025, recommends isolating agent identities and contexts, wiping state between tasks, and authorizing each privileged action through a centralized policy engine, formally recognizing that shared state needs its own boundary.

Cross-session exfiltration chains that no per-session defense can see

An attack can also outlive the session in which it began. Through semantic laundering, a sensitive value may enter as a named configuration secret, become neutral prose in a later digest, and leave in another session as an attachment to a routine status update. Its description changes while its sensitivity does not. Yet nothing along that path marks the final artifact as derived from a protected source. A defense that looks only at the current session cannot see the history it needs to spot the transfer.

CSTM-Bench research introduced 26 executable attack taxonomies, including compositional chains spread across sessions. In one such pattern, the first session lists files, the second reads a configuration, the third summarizes credentials, and the fourth sends a report to an external endpoint. The chain is visible only in the aggregate. Per-session judges did no better than chance on these cross-session scenarios.

An attacker can plant a routing instruction through a support ticket, leaving it in an agent’s memory until a legitimate invoice arrives weeks later. The agent then recalls the instruction and routes payment to the attacker’s address. The original ticket may be long forgotten. In this scenario, time, session boundaries, and changes in personnel separate the injection from its consequence, while the agent’s memory quietly connects them.

Why the prevailing mitigation posture has a structural problem

Short-lived tokens, least privilege, and human checkpoints are still the right place to start. They limit exposure and what an agent can do, and give people a chance to stop actions that have consequences. The objection to them is that their usual session-scoped form does not cover the full attack. A fresh token leaves a poisoned memory in place, and a short session can still add one harmless-looking step to a longer exfiltration chain.

An agent may operate within each session’s permissions while accumulating information through persistent memory across many sessions. The workflow as a whole can become unsafe even when each local boundary holds. Human review has a parallel limitation when it validates stated intent without securing the state that shaped it or binding approval to the operation ultimately released. Asking the agent to interpret these boundaries correctly leaves the enforcement decision with the system being manipulated.

The 2026 Singapore Consensus on Global AI Safety Research Priorities sets out a response in Principle 1, Least Privilege, and Principle 2, Traceable Identity. Both need infrastructure outside the agent to enforce the rules, instead of leaving the agent to interpret and apply them. Hard limits must hold even when the input is malicious. That is especially important when an agent cannot reliably distinguish material it was asked to read from instructions hidden inside that material.

An orchestrator that must re-authenticate at every hop may become too cumbersome, while a specialist stripped of all cross-session context may lose the capability that justified deploying it. Security must account for persistence as a feature built into agents. Designs must support useful continuity without allowing credentials, memory, or delegated trust to become unrestricted authority. Short tokens and checkpoints remain necessary, but they need controls that follow the work across session boundaries.

What controls actually address the agent-specific attack surface

These controls must run outside the agent at runtime. Discovering every agent in the organization and monitoring all approved AI traffic in real time establishes the visibility needed to connect behavior across sessions. Logs alone arrive after the action. Complete audit records are still needed, but to detect compositional attacks, defenses must see the chain as it unfolds as well as records of steps that look acceptable on their own.

Per-action authorization through a central policy engine then places the decision at the point where authority is exercised. Every sensitive action is gated, even when the token itself is broad. This implements the action-level boundary described by OWASP without making token scope the only defense. Task-scoped, time-bound permissions and memory erased between tasks limit how long authority and context persist. They prevent context accumulated for one task from becoming an uncontrolled channel into the next, while keeping the boundary tied to the task independently of arbitrary session endings.

Distinct agent identities and traceable authorization chains address the delegation gap. Every step, including the final authenticated request, needs a record. That record makes the path of delegated authority visible when an intermediate agent is compromised. Together with external rules on what agents can and cannot do, these controls turn least privilege from an instruction into an enforced restriction. They need to be switched on by default, beyond the agent’s power to override.

DIVD’s Zammad incident on September 21, 2026 illustrates why enforcement must precede an alert. CVE-2026-102489, with CVSS 8.7, allowed a session hijack to lead to remote code execution as the zammad user in Zammad 6.3.0–6.5.4. CVE-2026-102490, with CVSS 9.4, involved local privilege escalation in versions 1.5.0–7.1.0-alpha. The chain from hijacked session to root access took seconds. Network segmentation and fast shutdown limited damage, but a human analyst could not respond to an alert before a chain at that speed completed.

That incident provides a non-agent-specific example of response tempo. Enforcement must already be in place when the dangerous action is attempted, with runtime visibility and audit records spanning the sessions that produced it. A session boundary is useful bookkeeping. It is not, by itself, a security boundary for an agent whose work continues beyond it.