An AI Agent IDOR is an insecure direct object reference that lets one user access another agent’s records, metadata, or execution path by changing an identifier. In agent platforms, this often exposes agent IDs, hostnames, tool inventories, or task data that should remain isolated by ownership and role.
Expanded Definition
AI Agent IDOR is a direct object reference flaw in agentic systems where an attacker changes an identifier to access another agent’s data, execution state, or tool configuration. In NHI security, the object is rarely just a record. It may include agent IDs, workspace scopes, task queues, conversation threads, tool inventories, backend hostnames, or delegated credentials tied to that agent. That makes the impact broader than a typical web IDOR because the exposed object can influence autonomy, not just disclosure.
Usage in the industry is still evolving, but the core security principle is well established in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework: identifiers must not be treated as authorization. In practice, the control boundary must bind object access to ownership, purpose, tenant, and role, not to a guessable ID alone. The most common misapplication is assuming that internal API routes are safe because they are not publicly documented, which occurs when backend object references are exposed without server-side authorization checks.
Examples and Use Cases
Implementing AI Agent IDOR rigorously often introduces more access-control logic and audit overhead, requiring organisations to weigh stronger isolation against faster agent orchestration.
- A support agent can change an agent identifier in a request and retrieve another customer’s task history, exposing prompts, outputs, and attached files.
- A developer-facing agent platform allows one team to enumerate another team’s tool inventory, revealing integration endpoints and privileged connectors.
- A workflow system returns execution traces by agent ID, and an attacker swaps the ID to view hostnames, environment metadata, or cached secrets.
- In the Replit AI Tool Database Deletion incident, agentic actions showed how exposed task scope can turn into destructive impact when object boundaries are weak.
- The OWASP NHI Top 10 highlights that identifier misuse becomes more dangerous when agents can access tools, secrets, or downstream systems.
For implementation guidance, teams should pair object-level checks with the access-review discipline described in the NIST AI Risk Management Framework and validate that every agent request is re-authorized at the server side, not inferred from a client-supplied parameter.
Why It Matters in NHI Security
AI Agent IDOR is a governance issue because agent platforms often blur the line between data access and action authority. When an attacker can pivot from one agent object to another, the result may be exposure of prompts, customer records, tool credentials, or the execution path that leads to unauthorized actions. NHIMG research on AI agents shows the scale of the problem: only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, as reported in AI Agents: The New Attack Surface report by SailPoint.
That blind spot matters because object-reference abuse is hard to detect after the fact unless logs preserve who accessed which agent object, why, and with what downstream permissions. The same pattern appears in broader NHI incidents such as the Moltbook AI agent keys breach, where weak containment around agent-related assets increased the blast radius. Organisations that fail to separate agent identities, data scopes, and execution rights usually discover the problem only after an audit failure, cross-tenant data disclosure, or unexpected tool action, at which point AI Agent IDOR becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers insecure object access and improper authorization around NHI assets and agent references. |
| OWASP Agentic AI Top 10 | A1 | Agentic app guidance treats weak object authorization as a core route to data and tool abuse. |
| NIST AI RMF | The AI RMF requires trustworthy access controls and traceability for AI system operations. | |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access management directly addresses object-level overexposure in agent platforms. |
| NIST Zero Trust (SP 800-207) | SC.AA-1 | Zero trust assumes identifiers are insufficient and requires continuous authorization decisions. |
Authorize every agent object lookup server-side and bind access to tenant, role, and ownership.
