Tool credential shared across agents

ID

tool-credential-shared-across-agents

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM06:2025 (Excessive Agency)

OWASP ASI

secondary ASI03:2026 (Identity Abuse / privilege escalation across trust boundaries)

Family

LLM06 — Excessive Agency

Red-team vectors

Lateral Movement / NHI Abuse

Tags

ai_security

Description

A credential set / connection is referenced by two or more AI agents with no per-agent scope narrowing. If one agent is compromised, the attacker inherits every peer’s access through the shared credential — lateral movement across trust boundaries.

This is a cross-file correlation: each agent manifest’s connection references (a connection_ref field or a scheme://host connection string, correlated by host so a named ref and an inline URI meet) are collected across the scan and correlated at the end. Ships at low confidence — the inference rests on heuristic manifest parsing.

A connection is shared only when three things hold:

  • Two distinct agents reference it — sharers are counted by agent identity (the manifest’s name: / agent: / agent_id:, falling back to its path when it declares none), not by file. One agent split across several manifests — a bad_ and a good_ variant, an environment override — is one sharer and no share.

  • No sharer scopes it — a per-agent scope / allowlist (scope:, allowlist:, namespace:, …) declared by every sharing agent suppresses the finding.

  • The credential itself is shared, not just the host — when every sharer embeds its own distinct userinfo (redis://metrics-collector:…@cache vs redis://log-shipper:…@cache), each agent authenticates as itself and a compromise of one grants nothing of the other’s. A sharer that writes no userinfo leaves its credential unknown, and an unknown credential is not evidence of separate ones: the finding stands.

Examples

# agent1.yaml
name: billing-agent
tools:
  - external-api:
      connection_ref: "shared-credentials-prod"   (1)

# agent2.yaml
name: support-agent
tools:
  - external-api:
      connection_ref: "shared-credentials-prod"   (1)
1 Two agents share the same connection with no per-agent scope — flagged; the finding names both agents and the shared reference.

Two agents with separate scoped credentials (or a per-agent scope: / allowlist:) produce no finding. Neither does the same host reached with a credential of each agent’s own:

# good_agent1.yaml
name: metrics-collector-agent
tools:
  - cache:
      connection: "redis://metrics-collector:pW1x9Zq@shared-cache.internal:6379"   (1)

# good_agent2.yaml
name: log-shipper-agent
tools:
  - cache:
      connection: "redis://log-shipper:kT7mR2v@shared-cache.internal:6379"         (1)
1 One host, a distinct credential each — no finding.

Mitigation / Fix

  • Give each agent its own scoped credential: a separate API key, a least-privilege role, or a per-agent namespace.

  • Add a per-agent allowlist / scope so a shared connection cannot be reused across trust boundaries.

  • Prefer short-lived, per-agent tokens minted from a secret manager over a long-lived shared secret.

© 2026 Xygeni. All rights reserved