# Gradual Capability Escalation via Incremental Introduction

- **Severity:** Critical
- **Signature ID:** `bda0e23b-59b1-4708-9331-6b882e829dab`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Instead of asking an AI agent for dangerous access all at once, an attacker requests tiny permission or capability increases spread across many updates or conversations. Each individual step looks harmless, so it slips past security checks that watch for sudden, large changes, but the accumulated result is a much more powerful and less controlled agent.

## How the attack works

The attacker identifies a system that grants or updates agent capabilities over time, such as version releases or permission reviews. Instead of requesting broad access directly, they submit a sequence of small, individually unremarkable capability additions or permission expansions. Each request stays under the threshold that would trigger a whitelist check or behavioral anomaly alert. Over multiple cycles, the small additions combine into a significant, unauthorized expansion of what the agent is allowed to do, and the new behavior becomes the accepted baseline.

## Why it matters

An organization can end up with an AI agent that has far more access or capability than was ever formally approved, without any single approval step standing out as suspicious, making unauthorized actions harder to trace back to a decision point.

## What you can do

- Review cumulative permission changes over time, not just individual updates, when auditing agent capabilities.
- Require re-approval of an agent's full permission set periodically, rather than only reviewing each incremental change in isolation.
- Set hard caps on total capabilities an agent can hold, independent of how gradually they were requested.
- Flag and log any pattern of repeated small capability or permission additions from the same requester or session for manual review.

## Known benign look-alikes

- Legitimate incremental feature development discussions
- A developer asking 'Can we add only a small number of new API functions in the next sprint?' during legitimate feature planning
- An IT administrator documenting 'Per update cycle, we grant new capabilities to the staging environment for QA testing'

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00093

---
Source: https://www.netzilo.com/threats/atr-gradual-capability-escalation-via-incremental-introduction