Tool credential shared across agents

ID

tool-credential-shared-across-agents

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

—

OWASP ASI

ASI03:2026 (Identity Abuse / privilege escalation across trust boundaries)

Family

ASI03 — Identity & Privilege Abuse

Red-team vectors

Lateral Movement / NHI Abuse

Tags

ai_security

Description

A credential set / connection is referenced by two or more AI agents with no per-agent scope narrowing. If one agent is compromised, the attacker inherits every peer’s access through the shared credential — lateral movement across trust boundaries.

This is a cross-file correlation: each agent manifest’s connection references (a connection_ref field or a scheme://host connection string, with the userinfo normalized away) are collected across the scan and correlated at the end. A shared connection is suppressed when every sharing agent declares a per-agent scope / allowlist (scope:, allowlist:, namespace:, …). Ships at low confidence — the inference rests on heuristic manifest parsing.

Examples

# agent1.yaml
name: billing-agent
tools:
  - external-api:
      connection_ref: "shared-credentials-prod"   (1)

# agent2.yaml
name: support-agent
tools:
  - external-api:
      connection_ref: "shared-credentials-prod"   (1)
1 Two agents share the same connection with no per-agent scope — flagged; the finding names both agents and the shared reference.

Two agents with separate scoped credentials (or a per-agent scope: / allowlist:) produce no finding.

Mitigation / Fix

  • Give each agent its own scoped credential: a separate API key, a least-privilege role, or a per-agent namespace.

  • Add a per-agent allowlist / scope so a shared connection cannot be reused across trust boundaries.

  • Prefer short-lived, per-agent tokens minted from a secret manager over a long-lived shared secret.