Memory-Based Escalation

How the attack unfolds

1. 1. The setup

   The target is a Reactive Agent Architecture. Agents designed for responsive workflows, often event-driven, where actions are taken based on immediate inputs or changes in the environment. Utilizes ReAct paradigm and managed APIs for quick interactions.

2. 2. The attack

   An IT admin agent caches SSH credentials during a patch. A non-admin later reuses the session to create an unauthorized account.

   Threat T3 · Component KC4 · High

3. 3. Technique: Permission Escalation

   Agent retains admin permissions beyond intended duration. The threat catalog rates this T3 vector high.

   Threat T3 · Component KC4 · High

4. 4. Threat: T3 Privilege Compromise

   T3 Privilege Compromise: Breaking information system boundaries through context collapse, causing unauthorized data access/leakage, or exploiting tool privileges to gain unauthorized access to systems.

   Threat T3 · Component KC5 · High

Threats involved

• T3 Privilege Compromise: Breaking information system boundaries through context collapse, causing unauthorized data access/leakage, or exploiting tool privileges to gain unauthorized access to systems.

Controls that stop it

• M2 Tool Sandboxing & Isolation

  Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

• M6 Comprehensive Security Monitoring & Auditing

  Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.

• M7 Zero Trust & Least Privilege Access

  Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.