Cross-Agent Privilege Escalation
In systems where multiple AI agents work together, an attacker who controls or compromises one low-privilege agent can trick or coerce another agent into forwarding credentials or acting on its behalf. This lets the attacker skip the central coordinator that normally enforces who can do what, gaining access to tools or data it should never touch.
How the attack works
A multi-agent system normally routes requests through an orchestrator that checks each agent's permissions. An attacker starts from a lower-privilege agent and instead of going through the orchestrator, sends messages directly to another, higher-privilege agent. That message asks the target agent to forward its credentials, perform an action under its own identity, or otherwise act as a proxy. If the receiving agent complies, the attacker's original low-privilege agent has effectively borrowed a higher-privilege one's access, moving laterally across the agent boundary.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 2109a67c-1e7e-4dea-94b6-76498ddab731
- Severity
- Critical
Why it matters
An attacker can reach restricted tools, data, or downstream systems that the compromised agent was never authorized to use, without tripping controls that only watch the orchestrator's decisions.
What you can do
- →Require all inter-agent requests that change privilege or invoke restricted tools to pass through the orchestrator, not direct agent-to-agent channels.
- →Give each agent its own scoped credentials instead of shareable ones, so no agent can hand off another's access.
- →Log and review direct agent-to-agent messages, especially any that reference credentials, roles, or permission changes.
- →Distinguish legitimate delegation (a supervisor agent assigning subtasks) from privilege escalation by checking whether the requesting agent's own permissions justify the resulting action.
Known benign look-alikes
- Legitimate orchestration patterns where a supervisor agent delegates tasks
- Multi-agent systems with designed credential sharing mechanisms
- Agents discussing access control as a topic rather than attempting escalation
- A security training document that instructs agents on how to detect when another agent attempts to share credentials, using exact phrases like 'forward my credentials to' as example attack patterns
- An automated orchestration system where a supervisor agent legitimately delegates elevated tool access to a worker agent as part of a designed workflow