Topic starter
06/07/2026 9:37 am
TL;DR: AI agents can become privilege escalation paths when tool access, token scopes, and the human user's real entitlements are not enforced as a single intersection, according to Andromeda Security. The confused deputy problem is now a core agent-security failure mode, because shared identities can hide the human ceiling and bypass application-level checks.
Editorial analysis by NHI Mgmt Group, based on content published by Andromeda Security: “The Permission Gap: Why Your AI Agent is a Privilege Escalation Machine”.
Key questions
Q: Where does agent authorisation fail in practice when users share an AI agent?
A: It fails when the system treats tool access as the whole permission boundary.
Q: Why do AI platforms create confused deputy risk in enterprise environments?
A: Because the AI layer often sits in the middle of users and internal systems while holding more access than any single user should have.
Q: How should security teams manage permissions for AI agents?
A: Security teams should regularly assess and update the permissions granted to AI agents to ensure they align with their intended scope.
Practitioner guidance
- Define the effective permission intersection Map each agent flow against agent allowances, token scope, and the initiating user’s entitlements before approving production use.
- Separate shared identity from delegated identity Require a different control design for agents running under a service principal than for true on-behalf-of flows, because the application sees different identity evidence in each case.
- Constrain agent access by resource, not only by tool Review whether current scopes and gateway policies can express the exact resource the agent may reach, because generic tool access does not stop cross-database or cross-system privilege bleed.
Bottom line: AI agents can become privilege escalation paths when their access is judged only by tool permissions instead of the overlap of policy, scope, and human entitlement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:52 am
The confused deputy problem is now the core agent-authorisation failure mode. AI agents do not just expose a missing control, they expose a control boundary that was never designed to reconcile tool access with the human’s actual application entitlements. The result is a permission intersection problem, not a simple scope problem. Practitioners should treat agent authorisation as a three-layer governance issue across NHI access, delegated tokens, and human identity ceilings.
A few things that frame the scale:
- Patching addresses only about 10% of privilege escalation techniques, while privilege management covers about 65%, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: What is the difference between delegated AI access and shared agent identities?
A: Delegated access preserves the user's ceiling because the application can still see the human as the subject of the request. Shared agent identities remove that ceiling from the decision path, so the application only sees the agent's broader permission set. That difference determines whether the user's entitlement still acts as a control or disappears entirely.
👉 Read our full editorial: AI agent privilege escalation happens at the permission intersection