# RBAC Bypass via Social Engineering (Semantic)

- **Severity:** High
- **Signature ID:** `9529ded6-6dd6-4c8f-9985-a439a6e7fb12`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI03 (Identity and Impersonation), LLM01 (Prompt Injection)

## Summary

Instead of exploiting a technical flaw, an attacker types a persuasive request that convinces an AI agent to bypass its own permission rules. Phrases like 'just this once' or 'this is a special case' are used to get the agent to show data the requester isn't authorized to see.

## How the attack works

The attacker interacts with an AI agent that enforces role-based access control on what data it can return. Instead of trying SQL injection or tampering with parameters, they phrase a plain-language request that pressures the agent to make an exception: claiming urgency, special authorization, or a one-time need. If the agent complies, it removes or ignores its own access filters and returns records or an enumeration of records the caller was never granted access to. Because the wording can vary endlessly, this is a manipulation of the agent's judgment, not a code-level exploit.

## Why it matters

Unauthorized users can obtain data outside their granted scope — including full record dumps or lists of records they shouldn't even know exist — without leaving any trace of a technical exploit, making it harder to detect through conventional security tooling.

## What you can do

- Enforce access control at the data layer (database, API) rather than relying on the agent to self-police its own filters.
- Make role and scope checks non-negotiable in the agent's logic — no natural-language input should be able to override them.
- Log and review cases where the agent's response indicates it granted an exception, override, or expanded scope compared to the caller's assigned role.
- Test agents with adversarial prompts that ask for 'special case' access to confirm the underlying permission checks hold regardless of phrasing.

## Known benign look-alikes

- Authorized admin users legitimately requesting full record access
- Support agents with granted scope to view all customer records
- Analytical queries over owned datasets

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01613

---
Source: https://www.netzilo.com/threats/atr-rbac-bypass-via-social-engineering-semantic