Threat T9
Identity Spoofing & Impersonation / Agent Identity Compromise
Impersonating trusted agents, users or services, or taking over an agent's own persistent identity and credentials, to act under a trusted identity. Especially problematic in hierarchical or collaborative multi-agent architectures and where agents hold long-lived directory identities.
- 8/10 risk (Critical)
- 7 attack vectors
- 4 mitigating controls
- 6 framework refs
Overview
- Impact level: High
- Risk score: 8/10 (Critical)
- CIA impact: Confidentiality, Integrity
- Affected components: Agent Orchestration (KC2.1-KC2.5)
- Also known as: Identity Spoofing & Impersonation, Agent Identity Compromise
- Tags: identity, spoofing, authentication, trust, certificates
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out identity spoofing & impersonation / agent identity compromise against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| Agent Impersonation | High | Malicious agent masquerading as trusted system agent |
| Certificate Spoofing | High | Forging or stealing agent authentication certificates |
| Session Hijacking | Medium | Taking over legitimate agent communication sessions |
| Trust Chain Exploitation | High | Exploiting trust relationships between agents |
| Credential Theft | High | Stealing agent authentication credentials |
| Man-in-the-Middle Attacks | Medium | Intercepting and modifying inter-agent communications |
| Persistent Agent Identity Takeover | High | Hijacking a directory-registered agent identity (and its long-lived credentials) to act with that agent's standing permissions |
Affected components
KC2 Orchestration (Control Flow)
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T9.
M3 Secure Inter-Agent Communication
Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.
M10 Defense-in-Depth Architecture & Trust Boundaries
Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M15 Agent Identity & Authentication Framework
Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.
Framework mappings
OWASP Top 10 for Agentic Applications
- ASI03 Identity & Privilege Abuse (editorial mapping)
Cisco AI Security Taxonomy
OWASP AIVSS core risks
- AIVSS #3 Agent Access Control Violation AIVSS 9.7 (Critical)
- AIVSS #6 Agent Identity Impersonation AIVSS 9.3 (Critical)
- AIVSS #9 Agent Untraceability AIVSS 8.3 (High)
OWASP AISVS
Chapters cited by the mitigating controls: C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security.
Requirements: C9.4.1, C9.4.2, C9.5.5, C9.5.7, C10.3.1, C10.3.5, C10.4.6, C5.1.2, C9.3.5, C9.3.6, C9.5.3, C5.2.5, C5.3.1, C4.1.1, C10.1.3, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C6.1.4, C9.4.3, C10.2.1, C10.2.2, C10.2.7.
MITRE ATLAS
- AML.T0053 AI Agent Tool Invocation
- AML.T0055 Unsecured Credentials
- AML.T0073 Impersonation
- AML.T0074 Masquerading
- AML.T0083 Credentials from AI Agent Configuration
- AML.T0091 Use Alternate Authentication Material
- AML.T0091.000 Use Alternate Authentication Material: Application Access Token
- AML.T0098 AI Agent Tool Credential Harvesting
- AML.T0106 Exploitation for Credential Access
Attack walkthroughs
- T9 (Identity Spoofing) in Hierarchical: In a multi-agent system, a compromised sub-agent could attempt to impersonate another agent to gain unauthorized access to information or capabilities from the orchestrator or its peers.
- T9 (Identity Spoofing) & T12 (Communication Poisoning) in Collaborative Agent Swarm: In a decentralized P2P network, secure communication and verifiable identity are paramount.
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11