Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Privilege escalation

Also called: confused deputy

Privilege escalation is gaining more access than you were given. In AI systems it usually happens through an agent acting with its user's or service's permissions: an attacker with little access gets the agent to do something only a more privileged identity could do.

How it works

This is a confused-deputy problem: the agent holds the power and the attacker supplies the instructions, for example through a database comment, document or ticket the agent reads. Agents running as admins, with broad OAuth scopes or with shared service accounts make the gap large.

How to defend

Run agents with the least privilege that works, bind actions to the requesting user's permissions, and require approval for administrative operations.

Real cases 4 stories

  1. HIGH

    Vulnerability · Zenity Labs

    AgentCorruption: one prompt takes over Bedrock AgentCore agents

    AgentCorruption is a chain Zenity Labs demonstrated against Amazon Bedrock AgentCore, where one prompt to an exposed agent yields IAM credentials and then control of every AgentCore agent in the same AWS account and region.

  2. LOW

    Vulnerability · Microsoft · CVE-2026-69435 · CVSS 9.6

    Azure SRE Agent: Microsoft discloses a critical authorization flaw

    Microsoft published CVE-2026-69435 on October 8, 2026, a missing authorization flaw in Azure SRE Agent that it scores 9.6, critical. Microsoft states the hosted service is already fully fixed and that customers need take no action.

  3. CRIT

    Incident · CISA · CVE-2026-102489

    CISA: Zammad flaws exploited after agentic AI breached DIVD

    CISA added two Zammad helpdesk flaws, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities catalog on October 2, 2026, after DIVD said an agentic AI attack chained them to breach its network.

  4. HIGH

    Vulnerability · Embrace The Red · CVE-2026-65669 · CVSS 9.6

    SQL Server Copilot: prompt injection escalates a user to sysadmin

    CVE-2026-65669 let indirect prompt injection push GitHub Copilot in SQL Server Management Studio past its read-only mode and run T-SQL with a sysadmin's privileges. Microsoft rates it CVSS 9.6; SSMS 22.8.2 fixes it.