T9 (Identity Spoofing) in Hierarchical

How the attack unfolds

1. 1. The setup

   The target is a Hierarchical Agent Architecture. This architecture introduces a KC2.2 (Hierarchical planning) model where a central orchestrator agent decomposes complex tasks and delegates them to specialized sub-agents. These sub-agents may use specialized KC1.1 or KC1.4 (Fine-tuned) models.

2. 2. The attack

   In a multi-agent system, a compromised sub-agent could attempt to impersonate another agent to gain unauthorized access to information or capabilities from the orchestrator or its peers.

   Threat T9 · Component KC2 · High

3. 3. Technique: Trust Chain Exploitation

   Exploiting trust relationships between agents. The threat catalog rates this T9 vector high.

   Threat T9 · Component KC2 · High

4. 4. Threat: T9 Identity Spoofing

   T9 Identity Spoofing & Impersonation / Agent Identity Compromise: Impersonating trusted agents, users or services, or taking over an agent's own persistent identity and credentials, to act under a trusted identity. Especially problematic in hierarchical or collaborative multi-agent architectures and where agents hold long-lived directory identities.

   Threat T9 · Component KC2 · High

5. 5. In the wild: Cross-Agent Trust Exploitation

   ASI03 Identity & Privilege Abuse in the OWASP Top 10 for Agentic Applications describes the same pattern: A crafted email instructs an email sorting agent to instruct a finance agent to move money. The finance agent trusts the internal agent and processes the payment.

   Threat T9 · Component KC2 · High

Threats involved

• T9 Identity Spoofing & Impersonation / Agent Identity Compromise: Impersonating trusted agents, users or services, or taking over an agent's own persistent identity and credentials, to act under a trusted identity.

Controls that stop it

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M15 Agent Identity & Authentication Framework

  Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.