1. Plan: AI Policy & Safe Experimentation
1.1
Inadequate AI and Agentic Policy
1.10
No Vetting Path for Tools and External Context Sources
1.11
Missing Autonomy-Level Classification
1.12
No Action-Authorization Policy Defined
1.13
No Agentic Identity Policy Defined
1.2
Governance Misalignment
1.3
Undefined Risk Tolerance & Categorization
1.4
Unmonitored AI and Agent Experimentation
1.5
Insecure Experiment Logging & Monitoring
1.6
Overly Permissive Permissions in Experimentation
1.7
Experiment Output Data Leakage
1.8
Unauthorised / Prohibited Component Usage
1.9
Incomplete Threat Modeling for AI and Agentic Systems
2. Code/No Code: AI Asset Discovery
2.1
Incomplete Asset Inventory
2.2
Unidentified Third-Party AI and Agentic Integrations
2.3
Undocumented Data and Agent Communication Flows
2.4
Lack of Clarity on AI System Purpose and Criticality
2.5
Discovery of Outdated or Orphaned AI and Agentic Assets
2.6
Untracked Agent Identities
2.7
Unmapped Inter-Agent Topology
2.8
Unvetted Local / Endpoint Agents
3. Build: AI Security Posture Management
3.1
Vulnerable AI Frameworks, Harnesses, and Agentic Platforms
3.10
Failure to Specify or Enforce Secure Agent Posture
3.11
Insufficient Understanding of Agent Reachable Graph
3.12
Exposed AI and Agent Access Credentials in Discovered Assets
3.13
Over-Scoped Agent Tool Permissions and Connectors
3.14
Inherited Identity Sprawl
3.15
Insecure Agent Memory and Vector Store Configuration
3.16
Missing Per-Action Authorization Policy at Build
3.17
Unvetted MCP Server Definitions
3.18
Posture Drift / Configuration Drift Over Time
3.2
Insecure Agent Instructions Prompt and Configuration Design
3.3
Insecure ML, Data, and Agentic Pipeline Jobs
3.4
Intellectual Property (IP) Theft of Models
3.5
Misclassified or Undocumented Sensitive Data Usage
3.6
Insufficient Human Oversight in Model and Agent Development
3.7
Insecure Temporary Artifacts or Intermediate Data Storage
3.8
Unvetted Use of Open-Source and Third-Party AI and Agentic Components
3.9
Exposed or Hardcoded Credentials in Build Artifacts
4. Test: AI Red Teaming
4.1
Untested Agent
4.10
Untested Reasoning-Chain Manipulation
4.11
Untested Endpoint Agent Behaviors
4.2
Incomplete Red-Team Coverage
4.3
Lack of Risk Assessment Process
4.4
Insecure Storage of Red Teaming Artifacts
4.5
Insufficient Multimodal Security Testing
4.6
Limited Foreign Language Red Teaming
4.7
Limited Scope of Evasion Technique Testing
4.8
Untested Tool Chain and Multi-Agent Workflows
4.9
Untested Memory Persistence Attacks
5. Deploy: Runtime Guardrails
5.1
Insecure Agent Harness and Runtime Configuration
5.10
Malicious or Policy-Violating Action by Agent
5.11
Runaway Agent / Reasoning Loop DoS
5.12
Agent Resource Abuse
5.13
Missing Action-Level Authorization at Runtime
5.14
Excessive IAM Role Assumption by Cloud Agent Runtime
5.15
Agent Sandbox Escape via Runtime DNS or Filesystem
5.16
Cross-Tenant or Cross-Workspace Data Leak via Embedded Copilots
5.17
Maker-Identity Inheritance in Low-Code Agents
5.18
Agent Session Smuggling and A2A Identity Impersonation
5.19
Unsafe Consumption of Agent Output by Downstream Systems
5.2
Unauthorized Agent Config or System Prompt Tampering at Runtime
5.20
Privilege Amplification via Confused-Deputy Agent
5.3
Direct Prompt Injection at Agent Entry
5.4
Indirect / Cross-Source Prompt Injection (XPIA)
5.5
Tool Result Poisoning at Runtime
5.6
Agent Memory and Context Poisoning
5.7
Insecure Memory and Telemetry Storage
5.8
Sensitive Data Exfiltration via Agent Output or Tool Calls
5.9
Goal Hijacking / Intent Manipulation
6. Operate: Safe Execution Environment (Sandbox)
6.1
Sandbox Not Enabled or Inadequate Isolation
6.10
Autonomous Policy / Compliance Violation
6.11
Endpoint Agent Sandbox Bypass
6.12
Browser Agent Cross-Origin / DOM Trust Failure
6.13
Human Approval Fatigue / HITL Overload
6.14
Irreversible Agent Actions Without Rollback Path
6.2
Unrestricted API/Tool Invocation
6.3
Dynamic / On-the-Fly Dependency Injection
6.4
Task Decomposition for Policy Evasion
6.5
Indirect Prompt / Instruction Injection
6.6
Autonomous Resource Provisioning / Abuse
6.7
Cross-Agent / Inter-Agent Abuse
6.8
Agentic System Self-Modification
6.9
Covert Channel Use / Evasion
7. Monitor: AI Activity Tracing
7.1
Insufficient AI and Agent Interaction Logging
7.2
Missing Real-time Security Alerts
7.3
Undetected Agent Drift
7.4
Data Exfiltration via Monitoring / Telemetry
7.5
Absence of AI- and Agent-Specific Incident Response Plan
7.6
Missing Agent-Specific Anomaly Detection
7.7
Untracked Agent Decommissioning

SAIL 2.0

/

Deploy - Runtime Guardrails

/

Agent Session Smuggling and A2A Identity Impersonation

5.18

.

Agent Session Smuggling and A2A Identity Impersonation

sail
5.18
Download
Risk

Agent Session Smuggling and A2A Identity Impersonation

Description

Agents act under another identity through ACP/A2A gaps, session smuggling, or virtual-agent APIs that permit impersonation.

Example

An attacker exploits a virtual-agent API to act as a privileged user, performing actions the attacker is not authorized for.

Assets Affected

AI Agent

Agent Identity

Agent Communication Protocol (ACP)

Agentic Platform

Mitigation
  • Authenticate every handoff with scoped tokens
  • bind agent identity to action context
  • reject mismatched identity claims
  • alert on impersonation patterns.
Standards Mapping
  • ISO: A.4.5, A.6.2.6
  • OWASP agentic: ASI03, ASI07
  • OWASP LLM: LLM06:2025
  • EU AI Act: Art. 15(5)
  • DASF: Agents-Core 13.9, Agents-MCP Server 13.25
  • AIUC-1: B007, B008