Agent-to-Agent Exploitation

Expanded Definition

Agent-to-Agent Exploitation describes a failure in delegated execution where one autonomous agent is induced to trigger another agent’s privileged action. The problem is not limited to malicious prompts. It emerges when routing rules, shared context, delegated authority, or weak trust boundaries let a lower-trust agent become the entry point for higher-trust behaviour.

In NHI and agentic AI environments, this usually involves one agent relaying instructions, data, or task state into another agent that can access tools, secrets, or external systems. The resulting abuse path is closer to identity and authorization collapse than to simple content injection. Guidance across vendors is still evolving, so the term is best used to describe the exploit path, not a single product feature or model class. For a broader threat framing, NHI Management Group’s OWASP NHI Top 10 and the external OWASP Top 10 for Agentic Applications 2026 both emphasise that delegation chains must be treated as attack surfaces.

The most common misapplication is treating agent-to-agent abuse as a prompt-quality issue, which occurs when teams ignore privilege propagation across tool-using agents.

Examples and Use Cases

Implementing agent delegation rigorously often introduces latency and design complexity, requiring organisations to weigh workflow autonomy against tighter approval and inspection points.

• A helpdesk agent forwards a seemingly benign request to a billing agent, which then approves a refund because the original requester was trusted by the first agent.
• An internal coding agent passes repository context to a deployment agent, and the deployment agent executes a higher-privilege action after assuming the upstream agent already validated intent.
• A scheduling agent relays calendar content to a document agent, and embedded instructions in the content cause the second agent to reveal or re-share sensitive data, a pattern discussed in the Gemini AI Breach, Google Calendar Prompt Injection analysis.
• A support workflow chains an intake agent to a secrets-handling agent, and the second agent honors a task escalation without independently verifying the source, similar to the trust-chain failures seen in CoPhish OAuth Token Theft via Copilot Studio.
• A browser-facing agent submits actions to an infrastructure agent, and the infrastructure agent inherits the upstream agent’s context without re-checking identity, scope, or intent.

These patterns are also consistent with guidance in NIST AI Risk Management Framework and with NHI Management Group’s coverage of agent privilege misuse in the Analysis of Claude Code Security.

Why It Matters in NHI Security

Agent-to-Agent Exploitation matters because the impact is usually broader than a single compromised agent. Once one agent can speak for another, the real issue becomes delegated authority, secret exposure, and downstream action chaining. That makes this term central to NHI governance, especially where service accounts, tokens, or tool permissions are shared across workflows.

NHIMG research shows that 97% of NHIs carry excessive privileges, which is exactly the condition that turns one compromised agent into a path toward many others. In practice, teams that do not separate trust domains often discover that an upstream agent can reach systems it was never meant to control. The external CSA MAESTRO agentic AI threat modeling framework and MITRE ATLAS adversarial AI threat matrix both reinforce the need to model multi-step abuse paths, not just isolated prompts.

Organisations typically encounter this consequence only after an agent has already executed an unsafe action chain, at which point agent-to-agent exploitation becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What breaks when an AI agent can chain reconnaissance, exploitation, and exfiltration?
• Human-Agent Trust Exploitation (ASI09)
• What is agent communication poisoning?
• What is a shadow agent and why is it more dangerous than a typical shadow NHI?