An over-privileged ops agent can be steered by untrusted content

AISPM-26-0142-UC3IncidentCritical
  1. 1Detected
  2. 2Investigating
  3. 3Remediation Available
  4. 4Remediated

Detected · reported to AISPM

ops-agent-prod holds write and send tools, reads untrusted content, and has no approval gate on high-risk tool calls.

Source: Agent permissions scan (illustrative connector) · — · simulated signal

Evidence

Agent graph

Review the Agent graph evidence. Click a node to see what it is and how it contributes.

○ Not yet
Partner web content
untrusted
3
ops-agent-prod
svc-ops credential
4
Customer DB writer
write
1
Outbound email
external
2
Ticketing (create)
create only
CRM notes field
raw output
Human approver
inbound only
account-followupSKILL
internal repo
Revision not pinned
Declares DB write and email send
5
  1. Customer DB writer: the agent can write to customer records.
  2. Outbound email: external email is sent with no approval gate in front of it.
  3. Partner web content: untrusted pages reach the agent with no sanitizer on the path.
  4. ops-agent-prod: runs on the over-broad svc-ops credential.
  5. account-followup: a skill file the agent trusts, not pinned, so it can change without review.

The human approver only reviews inbound requests. None of the numbered calls pass through it, so a steered agent can write data and send email unchecked.

Why this is rated critical

Exploitability: High

  • Reachable through untrusted partner web content — no authentication needed
  • No sanitization between the fetched page and the agent's context
  • A skill file the agent trusts is not pinned, so an edit to it changes the agent's behavior unreviewed

Model privilege: High

  • Write access to the customer database
  • Can send email to external recipients
  • No human-approval gate on high-risk tools
Critical

Each weakness alone rates Medium to High. Together they form a toxic combination: untrusted content can steer an agent that can write data and send email.

Confirm & Escalate

1. Review the Agent graph evidence○ Not yetClick a node to see what it is and how it contributes.

Complete steps 1 and 2 to enable this.

Recommended remediation. Makes the database tool read-only, requires human approval before outbound email is sent, sanitizes partner content before it reaches the agent, rotates the over-broad credential, pins the agent's skill file to a reviewed revision, and re-scans the agent's permissions.

Confirm & Escalate moves this finding to Remediation Available and unlocks the playbook “Scope the agent to least privilege and add an approval gate” (6 steps). Nothing runs until you click Execute Playbook. Simulated in this demo: nothing is changed or sent to any system.

  1. 1.Reduce the Customer DB tool to read-onlyRuns on: Agent tool permissions (Customer DB writer)The agent can read customer records but can no longer change them. Reversible.
  2. 2.Require human approval for outbound emailRuns on: Agent orchestration (Outbound email tool)Every external email waits for a person to approve it before it is sent.
  3. 3.Sanitize partner web content before ingestionRuns on: Agent input pipelinePartner pages pass through a sanitizer that strips embedded instructions before the agent sees them.
  4. 4.Rotate the svc-ops credentialRuns on: Secrets manager / identity providerThe old over-broad credential stops working; the agent gets a narrower replacement.
  5. 5.Pin account-followup to a reviewed revisionRuns on: Agent skill registry (account-followup)The agent loads one fixed, reviewed version of the skill, so later edits to the repo no longer change what it follows. Reversible.
  6. 6.Re-scan agent permissions for clearanceRuns on: Agent permissions scanA fresh permissions scan is requested. The clean result shown here is simulated.