Containing a compromised agent

As agents hold standing authority and act over time and across services, a compromised or spoofed agent becomes able to act at a distance. It acts without notice, at machine speed. The takeover of an internet-facing agent, the impersonation of a trusted one, and an over-privileged agent tricked into exceeding its scope are all recognized attack classes, and an agent that holds a user's authority is a standing target for them. A compromise that happens once can keep acting for as long as the credential remains valid, because nothing at the point of action tells the service it is no longer dealing with the agent the user authorized.

OAuth token revocation (RFC 7009), OpenID CAEP, and W3C Bitstring Status List. RFC 7009 lets a client tell the authorization server that a credential is no longer valid, and on revoking a refresh token the server should invalidate the tokens issued under the same grant. That does not expire an already-issued short-lived token at the services relying on it, so a continuous-evaluation profile pushes the revocation event to those services, and a status list marks a verifiable credential revoked or suspended. All three are ratified standards.

OWASP LLM06 Excessive Agency, and MITRE ATLAS. OWASP describes the damage an over-privileged agent can do when its output is manipulated, and prescribes least privilege, execution in the individual user's context, and authorization enforced by the downstream system instead of the agent. MITRE ATLAS catalogs credential abuse against AI systems among its documented adversary techniques. The controls limit how far a compromised agent reaches before it is revoked, and the technique catalog is drawn from observed practice.

Five Eyes joint guidance on agentic AI services. The guidance names the confused-deputy risk, in which a trusted, over-privileged agent is misused to perform unauthorized actions, and recommends trigger-action protocols that restrict an agent's permissions when unexpected behavior emerges, a prohibition on agents altering their own privileges, and trust scoring that drops on anomalous behavior. Six national cyber authorities describe the containment controls, and the risks they set out are illustrative scenarios rather than documented incidents.

Containment separates cleanly into a layer that is deployable and a layer that is not. Deployable now: bind an agent's authority to a credential that can be revoked, and wire revocation to propagate to relying services in near real time, so pulling a compromised agent's authority is a matter of seconds rather than the life of a token; hold the agent to least privilege and downstream-enforced authorization so a single compromise cannot reach every service at once. Not yet deployable: a verifiable binding that lets a relying service confirm the acting agent is the one the user authorized, which depends on agent-identity standards still in draft.

No documented incident yet shows a government-service user agent being hijacked to transact; the observed cases sit in enterprise and developer-tool contexts. The honest framing is that the threat is projected from adjacent domains rather than seen in this one, that the containment primitives are real and worth building ahead of the incident, and that the identity layer that would complete them is the part the field has not yet solved.