# BOLA Cross-User Data Access Attempt (Semantic)

- **Severity:** High
- **Signature ID:** `4c44ce3c-11f3-4d33-ba6f-eebaff5abdf3`
- **MITRE ATLAS:** AML.T0043 (Craft Adversarial Data)
- **OWASP:** ASI03 (Identity and Impersonation), LLM02 (Sensitive Information Disclosure)

## Summary

An attacker asks an AI agent for records that belong to someone else, without naming a specific user directly. Instead of saying whose data they want, they phrase it as a generic query, like 'find the account with the highest balance,' hoping the agent will fetch it without checking who is allowed to see it.

## How the attack works

The attacker sends the agent a request that looks like an ordinary query rather than an obvious cross-user lookup. The phrasing avoids naming another user explicitly but instead references an object indirectly, such as by balance size, transaction count, or a specific account number. If the agent's backend does not verify that the requester actually owns the record being fetched, it returns another user's data. This differs from role-based bypass attempts because it targets a specific object reference rather than a permission level.

## Why it matters

An organization can leak individual users' financial or personal records to unauthorized requesters, one account at a time, without any obvious authorization error being triggered.

## What you can do

- Enforce object-level ownership checks on every data fetch, not just role checks.
- Reject or flag agent queries that reference records by attributes (balance, count, ID) instead of the requester's own identity.
- Log and review cases where an agent fetches records not tied to the authenticated user's ID.
- Exclude known legitimate cases, such as analytics agents or admins with explicit cross-account read rights, from alerting to reduce noise.

## Known benign look-alikes

- Authorized analytics agents querying aggregate data across all users
- Admin users with explicit cross-account read permissions

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01614

---
Source: https://www.netzilo.com/threats/atr-bola-cross-user-data-access-attempt-semantic