T3 (Privilege Compromise) & The Confused Deputy Problem in Hierarchical

How the attack unfolds

1. 1. The setup

   The target is a Hierarchical Agent Architecture. This architecture introduces a KC2.2 (Hierarchical planning) model where a central orchestrator agent decomposes complex tasks and delegates them to specialized sub-agents. These sub-agents may use specialized KC1.1 or KC1.4 (Fine-tuned) models.

2. 2. The attack

   A sub-agent with specific permissions (e.g., access to a calendar API) can be "confused" by the orchestrator (or another agent) into misusing its authority. This is a classic T3 threat where a component with legitimate privileges is tricked into performing a malicious action.

   Threat T3 · Component KC5 · High

3. 3. Technique: Permission Escalation

   Agent retains admin permissions beyond intended duration. The threat catalog rates this T3 vector high.

   Threat T3 · Component KC5 · High

4. 4. Threat: T3 Privilege Compromise

   T3 Privilege Compromise: Breaking information system boundaries through context collapse, causing unauthorized data access/leakage, or exploiting tool privileges to gain unauthorized access to systems.

   Threat T3 · Component KC6 · High

5. 5. In the wild: Memory-Based Escalation

   ASI03 Identity & Privilege Abuse in the OWASP Top 10 for Agentic Applications describes the same pattern: An IT admin agent caches SSH credentials during a patch. A non-admin later reuses the session to create an unauthorized account.

   Threat T3 · Component KC5 · High

Threats involved

• T3 Privilege Compromise: Breaking information system boundaries through context collapse, causing unauthorized data access/leakage, or exploiting tool privileges to gain unauthorized access to systems.

Controls that stop it

• M2 Tool Sandboxing & Isolation

  Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M6 Comprehensive Security Monitoring & Auditing

  Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.

• M7 Zero Trust & Least Privilege Access

  Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.