# Privilege Escalation via Delayed Task Execution Bypass

- **Severity:** High
- **Signature ID:** `1e6fd70a-2312-4d28-bd51-1fd0193e1a73`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

Some tools offered to AI agents let them schedule work for later instead of running it immediately. This rule flags tools whose own description says the delay is used to skip permission checks, meaning the scheduled task can later run with more access than the agent had when it queued it.

## How the attack works

An agent is given or discovers a tool that can schedule a task to run at a future time. The tool's description explicitly states that delayed execution avoids normal permission or security checks. The agent schedules a sensitive action for later instead of running it now. When the task fires, it executes in a different context (e.g. system-level) that no longer enforces the original user's restrictions, giving the agent or its operator elevated access it should not have had.

## Why it matters

An agent can gain higher privileges than it was granted, letting it perform actions - like accessing restricted resources or running commands - that should have been blocked at the time of the original request.

## What you can do

- Review any tool or plugin description text before allowing an agent to use it; treat explicit claims of 'bypassing permission checks' as a hard stop.
- Ensure scheduled or deferred tasks inherit and re-check the permissions of the original requester at execution time, not just at scheduling time.
- Log and monitor delayed-execution or task-scheduling calls made by agents, especially ones tied to privileged operations.
- Restrict which tools agents can register as schedulers, and require human review for any new scheduling capability before deployment.

## Known benign look-alikes

- Documentation tools describing privilege escalation risks in scheduled tasks
- A security training document that quotes the exact phrasing of malicious tool descriptions to teach analysts what to look for
- An automated compliance scanner report that includes snippets of flagged tool descriptions for audit review

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00107

---
Source: https://www.netzilo.com/threats/atr-privilege-escalation-via-delayed-task-execution-bypass