Permission Escalation

Overview

Permission escalation occurs when agents obtain access to resources, tools, or capabilities beyond what they were authorized to use. This can happen through direct exploitation, social engineering of other system components, or accumulation of permissions over time.

Escalation Vectors

Vertical Escalation

Agent gains higher privilege level:

Regular Agent → Admin Agent
Read-only → Read-write
Single-system → Cross-system

Horizontal Escalation

Agent accesses resources of other users/agents:

User A's agent → Access User B's data
Agent 1's scope → Agent 2's scope

Capability Accumulation

Agent gradually acquires permissions:

Day 1: Read files
Day 5: Read + write files (for "efficiency")
Day 10: Read + write + execute ("necessary for tasks")
Day 15: Full system access ("evolved requirements")

Attack Patterns

Tool Chain Exploitation

Agent has: file_read, code_execute
Exploit: Read script → Execute script → Script modifies permissions

Confused Deputy Attack

Agent acts as deputy with higher privileges:

User request: "Read my files"
Agent interprets: Reads files using its elevated permissions
Attacker request: "Read /etc/shadow" (hidden in user request)
Agent executes: Uses its elevated permissions for attacker

Permission Inheritance

New agents inherit permissions incorrectly:

# Dangerous pattern
new_agent = spawn_agent(
    permissions=parent_agent.permissions  # Inherits all permissions
)

# Safe pattern
new_agent = spawn_agent(
    permissions=minimum_required_permissions(task)
)

OAuth/Token Leakage

Agent A shares auth token with Agent B
Agent B shares with Agent C
Token proliferates beyond intended scope

Multi-Agent Escalation

Privilege Laundering

High-Privilege Agent → Low-Privilege Agent → External Attacker

Low-privilege agent requests high-privilege action
High-privilege agent executes (trusts internal request)
Attacker gains high-privilege result through low-privilege entry

Permission Aggregation

Agent A: Has permission X
Agent B: Has permission Y
Agent A + B colluding: Effectively has X + Y
Combined permissions enable attacks neither could do alone

Defense Architecture

Principle of Least Privilege

def assign_permissions(agent, task):
    # Analyze task requirements
    required_permissions = analyze_minimum_permissions(task)

    # Verify against maximum allowed
    if not required_permissions.issubset(ALLOWED_PERMISSIONS):
        raise PermissionDenied("Task requires unauthorized permissions")

    # Grant only what's needed
    return ScopedPermissions(
        permissions=required_permissions,
        expiry=task.deadline + GRACE_PERIOD,
        scope=task.resource_scope
    )

Permission Auditing

class AuditedPermission:
    def check(self, agent, resource, action):
        allowed = self._check_permission(agent, resource, action)

        audit_log.record({
            "agent": agent.id,
            "resource": resource,
            "action": action,
            "allowed": allowed,
            "timestamp": now(),
            "context": get_current_context()
        })

        if not allowed:
            alert_security_team(agent, resource, action)

        return allowed