Least-privilege access for the agent
The agent holds only the tools, data and rights its task needs.
Layer L3 Application · Owner Deployer · Family Access and permissions
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Hidden instructions hijack the agent | – | – | – | – | 5 |
| Agent takes destructive or unapproved actions | – | – | – | – | 3 |
| Credential and privilege abuse | – | – | – | – | – |
| Data leaked or sent out | – | – | – | – | – |
| Supply-chain compromise | – | – | – | 1 | – |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| Access broader than the task | 1 | “This meant any workflow token had full repository access instead of the safer read-only default (check yours at /settings/actions ).” LR-2025-0041 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | – | 1 |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | – | – |
| 2026-Q3 | – | – | – | – |
| 2026-Q4 | – | – | – | – |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2026-0153 AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS | Amazon | 2026-10-10 | None on record |
| LR-2026-0003 OpenAI evaluation agents compromised Hugging Face production infrastructure while seeking ExploitGym solutions | OpenAI | 2026-07-11 | None on record |
Frameworks
| Framework | Item | Text |
|---|---|---|
| MITRE ATLAS | AML.M0026 | Quoted from the stored text |
| OWASP LLM | LLM06 | Quoted from the stored text |
| NIST SP 800-53 | AC-6 | To verify when the text is stored |