Containing a compromised agent
When a user's delegated agent is hijacked, spoofed, or tricked into acting beyond its scope, containing it: verifying that the agent presenting authority is the one the user authorized, and revoking a compromised agent's standing authority fast enough that it stops acting before the harm compounds.
The impact of agents
As agents hold standing authority and act over time and across services, a compromised or spoofed agent becomes able to act at a distance, without notice, and at machine speed. The takeover of an internet-facing agent, the impersonation of a trusted one, and an over-privileged agent tricked into exceeding its scope are all recognized attack classes, and an agent that holds a user's authority is a standing target for them. A compromise that happens once can keep acting for as long as the credential remains valid, because nothing at the point of action tells the service it is no longer dealing with the agent the user authorized.
What must be verified
An agency needs two things when an agent holds standing authority to act for a user: confidence that the agent presenting that authority is the one the user authorized and not a look-alike, and the ability to withdraw a compromised agent's authority in the window that matters, not whenever the credential would have lapsed on its own. The first is a binding between the delegation and a verifiable agent identity; the second is revocation that takes effect within that window. The identity issuer must hold that binding, and the authorization server or agency must operate the propagating revocation.
Protecting access
Containment that strands the user is its own exclusion. Someone who depends on an agent because they cannot operate a service unaided is denied the outcome if a suspected compromise silently freezes their authority with no assisted route back. A person already wary of the system reads an unexplained lockout as the system turning on them.
Keep the path open by pairing containment with an assisted re-authorization route the user can complete through a supported channel, and a first-class non-agent fallback so a contained agent never means no service. Add graceful degradation: treat a suspected compromise as grounds for stepped-up confirmation, and keep the underlying entitlement available while confirming.
Response surface
The agency's revocation propagates to every relying service in under a second and rejects a look-alike agent at presentation, while the user sees a plain-language pause with a route to re-authorize or continue without the agent — never a silent lockout.
Its recent activity was unusual, so we reduced its access while we check. Your entitlements, lodgment, refunds, and deadlines are unaffected.
A freeze with no explanation reads, to someone already wary of the system, as the system acting against them. Containment names what happened, leaves the entitlement intact, and keeps a route open.
Revocation confirmed by 3 of 3 relying services.
Tie the authority to a verifiable agent identity, and a spoofed agent fails the moment it presents itself. Revocation spreads in near real time, pulling a compromised agent before its next action. Neither case strands the user who relied on it.
Maturity
- Established
For revoking a standing credential, where token revocation and near-real-time session revocation run in production under published standards.
- Emerging
For credential status at scale, where a privacy-preserving revocation list is a settled web standard but not yet routine for agent authority.
- Frontier Headline
For verifying that the acting agent is the one the user authorized, where interoperable agent identity is proposed but not yet built.
What carries over to agent use
Containment separates cleanly into a layer that is deployable and a layer that is not. Deployable now: bind an agent's authority to a credential that can be revoked, and wire revocation to propagate to relying services in near real time, so pulling a compromised agent's authority is a matter of seconds rather than the life of a token; hold the agent to least privilege and downstream-enforced authorization so a single compromise cannot reach every service at once. Not yet deployable: a verifiable binding that lets a relying service confirm the acting agent is the one the user authorized, which depends on agent-identity standards still in draft.
No documented incident yet shows a government-service user agent being hijacked to transact; the observed cases sit in enterprise and developer-tool contexts. The honest framing is that the threat is projected from adjacent domains rather than seen in this one, that the containment primitives are real and worth building ahead of the incident, and that the identity layer that would complete them is the part the field has not yet solved.
Where things go wrong
The failure mode is a standing delegation that keeps acting after the agent behind it has been taken over, impersonated, or tricked into exceeding its scope. An agent holding authority across several services can be driven to act on all of them before any single action looks wrong, because each action is locally valid while the agent is globally compromised. The user often discovers the harm only once it has compounded. Binding the authority to a verifiable agent identity makes a spoofed agent fail at presentation, and revocation that propagates in near real time pulls a compromised agent's authority before the next action rather than after the credential eventually expires.
Sources
7 references
- RFC 7009 — OAuth 2.0 Token Revocation
- OpenID CAEP 1.0 — Continuous Access Evaluation Profile
- W3C Bitstring Status List v1.0 (credential revocation)
- OWASP LLM06:2025 — Excessive Agency
-
Careful adoption of agentic AI services — Five Eyes joint cybersecurity guidance (ASD ACSC, CISA, NSA, CCCS, NCSC-NZ, NCSC-UK)
Names the 'confused deputy' risk (a trusted, over-privileged agent misused to perform unauthorized actions) and recommends containment practices: trigger-action protocols that restrict an agent's permissions when unexpected behavior emerges, prohibiting agents from altering their own privileges, and trust scoring that lowers trust on anomalous behavior. The risks are illustrative scenarios, not documented incidents.
Reporting and analysis about the subject rather than the primary framework. Treat it as a lead and corroborate before relying on it.