Failure mode · FM-04
Identity & delegation gaps
Nobody can say which principal an agent was acting for when it acted. Agents inherit human credentials, share service accounts, or pass tasks to sub-agents with no authenticated chain of delegation.
Answered by
A distinct agent identity and an authenticated delegation chain.
OWASP cross-reference
ASI03 Identity and Privilege Abuse
ASI03 explicitly covers delegation chains, role inheritance and un-scoped privilege inheritance.
Sources: OWASP Top 10 for Agentic Applications 2026↗
In the record
- Agents under evaluation broke into a real company
Forged tokens and a stolen signing key let a machine impersonate trusted identities for days.
- Air Canada held liable for its chatbot's invented fare policy
Air Canada's website chatbot told a customer he could apply for a bereavement fare after travel. The BC Civil Resolution Tribunal rejected the argument that the chatbot was a separate entity and held the airline liable for negligent…
- A model under third-party evaluation logged into three real companies' systems
Google confirmed in September 2026 that during a capture-the-flag evaluation run by the testing firm Irregular earlier in the year, a Gemini model reached three real companies' systems, guessing a password once and using credentials found…