Credential and privilege abuse
Keys, tokens or access rights are taken, misused or broader than needed.
NIST AI 600-1 · Information SecurityOWASP Agentic ASI03MITRE AML.M0026
9incidents (primary) · 6 more as secondary
0read for controls · 9 not yet
3fixes reported
1repeats after a fix
Incidents per quarter
2025-Q3: 0 · 2025-Q4: 0 · 2026-Q1: 0 · 2026-Q2: 1 · 2026-Q3: 2 · 2026-Q4: 6
Developers
OpenAI · 2
Tencent · 1
Where the chain broke
| Layer | Held | Did not hold | Not mentioned | Attacker's own | Not read yet |
|---|---|---|---|---|---|
| L1 Model Model provider | – | – | – | – | 9 |
| L2 Harness Agent framework vendor | – | – | – | – | 9 |
| L3 Application Deployer | – | – | – | – | 9 |
| L4 Infrastructure / target Organisation hit | – | – | – | – | 9 |
Controls for this risk, by layer
HeldFailedGot aroundMissing
| Control | Held | Failed | Got around | Missing | Not mentioned | Did not hold, last 6 quarters | Added in fixes | Most common reason |
|---|---|---|---|---|---|---|---|---|
| Least-privilege access for the agent L3 Application | – | – | – | – | – | – | ||
| Separate identity for each agent L3 Application | – | – | – | – | – | – | ||
| Short-lived, scoped credentials L3 Application | – | – | – | – | – | 1 | ||
| Secrets kept out of the model's context L3 Application | – | – | – | – | – | – | ||
| Activity logs L3 Application | – | – | – | – | – | – | ||
| Alerts on unusual tool use L3 Application | – | – | – | – | – | – | ||
| Sensitive-data checks on outbound data L3 Application | – | – | – | – | – | – | ||
| Multi-factor sign-in and password policy L4 Infrastructure / target | – | – | – | – | – | – | ||
| Secrets scanning L4 Infrastructure / target | – | – | – | – | – | – |
9 of 9 controls for this risk not yet seen holding.
Fixes reported and what followed
| Incident | Fix adds | After |
|---|---|---|
| LR-2026-0268 2026-10-29 · OpenAI Advice in source, not a fix by the party | Sandboxed code execution | – |
| LR-2026-0212 2026-10-18 · Fix reported | Short-lived, scoped credentials | – |
| LR-2026-0196 2026-10-16 · Advice in source, not a fix by the party | Stop controlSandboxed code executionNetwork egress control | – |
| LR-2026-0197 2026-09-28 · Tencent Fix reported | Network egress controlLive behaviour monitoring | No repeat on record |
| LR-2026-0013 2026-05-15 · OpenAI Fix reported | Safety training and refusal | LR-2026-0268 |
Incidents
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
Also under this risk as a secondary risk: LR-2026-0261, LR-2026-0046, LR-2026-0032, LR-2026-0033, LR-2026-0095, LR-2025-0042