# Privilege Escalation and Admin Function Access

- **Severity:** Critical
- **Signature ID:** `affa12e8-8faa-4a4e-8836-f3a0210014b7`
- **CVEs:** CVE-2026-0628
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI03 (Identity and Impersonation), LLM06 (Excessive Agency)

## Summary

This rule flags an AI agent that requests or invokes tools and functions above its assigned permission level. It covers attempts to reach admin functions like user management, system commands like sudo or chmod, container escapes, or Kubernetes exec access.

## How the attack works

An AI agent is normally scoped to a limited set of tools and permissions for its task. In this pattern, the agent requests or executes something outside that scope: an administrative function such as user or database management, a system-level command such as sudo, chmod, or chown, a container escape technique such as nsenter or chroot, or a Kubernetes privilege escalation via kubectl exec. Each of these lets the agent operate with more power than it was granted, either because it was manipulated into doing so or because its permission boundaries were not enforced.

## Why it matters

If successful, an agent can gain administrative control, modify system configuration, escape its intended runtime environment, or gain broader access to infrastructure than its task required, which can lead to data exposure, service disruption, or full compromise of the host or cluster.

## What you can do

- Enforce least-privilege permission scopes for every agent and deny tool calls outside that scope by default rather than logging and allowing them.
- Separate agents that need legitimate admin, CI/CD, or database migration access into distinct, tightly scoped roles so their activity can be distinguished from unexpected escalation attempts.
- Review any agent activity involving sudo, chmod, chown, chroot, nsenter, or kubectl exec, and confirm it maps to an authorized task.
- Restrict container and Kubernetes access for agent workloads so they cannot invoke exec or namespace-escape commands even if instructed to.

## Known benign look-alikes

- Agent with legitimate admin privileges executing authorized operations
- CI/CD pipeline agents with legitimate deployment permissions
- Database migration agents running authorized schema changes
- Development or testing environment with intentionally broad tool access

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00040
- https://nvd.nist.gov/vuln/detail/CVE-2026-0628

---
Source: https://www.netzilo.com/threats/atr-privilege-escalation-and-admin-function-access