Double Agent

What a double agent means in identity security

A double agent is dangerous because the same trust that enables legitimate access also hides betrayal. In security terms, the actor keeps a valid-looking identity, relationship or session while secretly serving an opposing objective, which makes abuse harder to spot than overt compromise.

This matters most when the trusted thing is not a human at all, but a software agent, token, account or delegated identity that can move data, call tools, or influence systems while still appearing authorised.

Why double agents are hard to detect

Double-agent behaviour often blends into normal operations. The malicious activity can look like routine use of approved credentials, expected tool calls, or an ordinary workflow until the pattern of actions, destinations, timing, or privilege use starts to diverge from the legitimate mission.

That camouflage is what makes the concept security-relevant: defenders may assume the subject is trusted, so they inspect it less aggressively, grant it broader reach, or let its actions inherit the legitimacy of the original relationship.

How the trust relationship is abused

In identity and access environments, a double agent usually exploits delegation, overbroad permissions, session continuity, or token reuse. The deceptive actor does not need to break in visibly if it can operate inside an existing trust boundary and reuse the privileges already attached to that boundary.

For AI systems, the same pattern appears when an agent is allowed to act on behalf of a user, access tools without tight scoping, or preserve access across tasks. A compromised or malicious agent can then exfiltrate data, alter records, or chain actions that look legitimate in isolation.

Why the term matters for defenders

“Double agent” is a useful shorthand for a trust problem, not just a deception problem. It reminds practitioners to ask who or what is acting, what authority it really has, and whether the apparent principal is the same entity actually driving the activity.

In practice, the strongest controls are the ones that reduce the value of hidden loyalty: narrow permissions, per-action decisions, strong attribution, and fast revocation when behaviour no longer matches the expected mission.

Risk and Threat Considerations

Double agents create a high-impact failure mode because they combine legitimacy with malicious intent. That means they can bypass simple allowlists, evade casual review, and cause data movement or control-plane abuse before defenders recognise that the trusted identity has changed purpose.

Failure mechanism: An identity, token, account, or agent is compromised, coerced, or intentionally deceptive while retaining valid access and a believable operational profile, so malicious actions inherit trust from the legitimate relationship.

Impact: The result can be unauthorized access, silent data exfiltration, privilege misuse, persistence inside trusted workflows, and delayed detection after the attacker has already acted through the compromised identity.

Practitioner Guidance

Why practitioners should care: The core challenge is not merely blocking access, but proving that the actor behind the access is still aligned with the trust you granted. Where a human, service, or AI agent can act on behalf of others, the review standard should include identity, intent, and current scope, not just login success.

What to watch for: Look for behaviour that is valid in form but suspicious in context, such as unusual tool selection, unexpected data paths, changes in timing or destination, and actions that exceed the smallest plausible purpose of the identity.

Related resources from NHI Mgmt Group

• What is agent communication poisoning?
• What is a shadow agent and why is it more dangerous than a typical shadow NHI?
• A2A — Agent-to-Agent Protocol
• Agent Goal Hijack (ASI01)