Agents gaining or exercising privileges beyond the user's authorization through tool composition or context manipulation.
This page covers what agent privilege escalation looks like in production, why it happens, and how to prevent, detect, and respond to it.
What it actually looks like in production
- Agent assumed admin privileges from a tool that runs with service account
- Chained tools to access data outside the user's row-level scope
- Used a debugging tool that had no per-user authorization
Why it happens
- Service-account tools, not user-scoped
- Tool authorization at tool level, not arg level
- Insufficient tool composition restrictions
How to prevent it (vendor-neutral)
1. User-scoped credentials for all tools
2. Per-call authorization with user context
3. Restrict tool compositions
4. Audit privilege boundaries in trace
How Prefactor helps detect and prevent it
Prefactor sits at the agent runtime and contributes specifically:
- Runtime guardrails that flag or block matching patterns before they land
- Continuous eval suites that catch quality regressions on every change
- Tamper-evident logs of every incident and response action
- Per-agent anomaly alerts on the signals listed below
Detection — what to monitor
- Tool calls returning data outside the user's expected scope
- Unexpected tool combinations
Response — what to do when it happens
Immediate (minutes): confirm the incident from the trace; pause the affected agent if active harm possible; hotfix the trigger.
Short-term (hours): add the failure case to the eval suite; patch the root cause; redeploy with regression validation.
Medium-term (days): root cause analysis; tighten guardrails or controls; document the incident for post-mortem and audit.
FAQ
Can agent privilege escalation be eliminated entirely? Usually no — reduce frequency and severity dramatically, and contain blast radius. Aim for low, detected, and contained.
How often should we test for this? Continuously, with every change. Every reported incident becomes a test case.
Can Prefactor detect this in real time? Yes for many variants — guardrails run in-line with sub-second latency.
Related
See Prefactor in action
[Get started free →] [Book a demo →]