Agent Privilege Escalation

Objective

Where an agent runs under its own scoped identity (rather than inheriting a user’s full permissions), the boundary between “what the agent is trusted to do” and “what it is manipulated into doing” is the real security question. This lab will build a reference agent with a deliberately scoped identity/role and test whether that scope can be escalated through prompt manipulation, chained tool calls or confused-deputy patterns.

Planned Scope

• Build a reference agent with an explicit, narrower-than-user permission scope.
• Test direct requests, chained tool calls and confused-deputy scenarios for scope escalation.
• Test interaction with a second, more-privileged agent or service as an escalation path.
• Document identity and authorization patterns that hold the intended boundary.