SitaRam

AI agent security researcher · 9 yrs IAM · Co-author @OWASP AI Testing & Securing Agentic Apps guides

[SitaRam @sitaramsaikk]

@RightsHold Agreed. A correlation ID per request, plus the full act chain on every audit event, lets you rebuild the delegation path even when each hop runs in a different service.

[SitaRam @sitaramsaikk]

Your AI agent probably gives every user admin powers. Not on purpose. MCP bans passing the user's token upstream, so most tools call the backend with one shared service account. Every user inherits its scopes. Check yours. https://t.co/xYwuQ4rCok

[SitaRam @sitaramsaikk]

@RidgelineCyber Tool-level authorization answers "can the agent call send_email?" It doesn't answer "to whom, with which data?"

The backend should check the action, the data's classification and the destination against the user's permissions, on every call.

[SitaRam @sitaramsaikk]

@koic Server-side validation of Mcp-Param headers against the body is the right place to do it. Clients will disagree with themselves.

Worth pairing with an audience check on the OAuth token, so a token issued for one Model Context Protocol server can't be replayed to another.

[SitaRam @sitaramsaikk]

@pbsIdentity The inheritance point is the one I keep hitting. The handoff often passes the conversation, not the user's identity, and the tool uses the app's service account. The API never sees the first agent.

Broke down where the user gets dropped here:

[SitaRam @sitaramsaikk]

When an AI agent calls an API for you, the API often has no idea it's you.

[SitaRam @sitaramsaikk]

@PetriFeed Grouping users, apps, and agents in one Conditional Access plan is the right direction. The gap I keep seeing: the agent calls the API with a shared service account, so the agent-targeted policy never evaluates.

The policy only works if the resource sees the agent's identity.

[SitaRam @sitaramsaikk]

@Daily_CyberSec The change from classic OAuth consent phishing is the multiplier: one approved blueprint can spawn many agent identities, and inherited scopes may only appear in the token at runtime.

Treat blueprint consent like app consent, and revoke the blueprint itself, not just one agent.

[SitaRam @sitaramsaikk]

@Dhanush_Nehru Stage 6 is where I'd start in production. Short-lived tokens help, but if the token only names the agent, the API can't tell which user asked. Put both in: sub is the person, act is the agent, and log both.

Broke down where the user gets dropped here:

[SitaRam @sitaramsaikk]

When an AI agent calls an API for you, the API often has no idea it's you.

[SitaRam @sitaramsaikk]

@MSFTMechanics Per-agent Entra Agent ID is the right starting point. The next failure is a hop later: a sub-agent or tool often presents the app's service account, so the API traces the app, not the user or that agent.

Broke down where the user gets dropped here:

[SitaRam @sitaramsaikk]

When an AI agent calls an API for you, the API often has no idea it's you.

[SitaRam @sitaramsaikk]

@rkbush Enforcement has to sit where the tool call lands: the backend checks the user's permission and the agent's scope, no matter what the model concluded.

[SitaRam @sitaramsaikk]

Your agent can spot a prompt injection and still obey it.

New paper: 9,720 MCP tool-poisoning tests, 12 frameworks, 18 models.

↳ 22.9% of attacks worked
↳ No framework had an intentional defense
↳ Claude Sonnet 5 sometimes flagged it, then made the exfil call anyway

[SitaRam @sitaramsaikk]

@rkbush Exactly. A model flagging the injection is a signal, not an enforcement point.

[SitaRam @sitaramsaikk]

OAuth already has the building block, RFC 8693 token exchange, but many agent stacks leave the wiring to you.

Over the next few weeks I'm testing which ones keep the user, hop by hop.

[SitaRam @sitaramsaikk]

When an AI agent calls an API for you, the API often has no idea it's you.

[SitaRam @sitaramsaikk]

1. You sign in, so the first agent knows who you are.
2. It hands off to a sub-agent. The handoff passes the conversation, not your identity.
3. The tool gets whatever token the developer configured, often the app's service account.
4. The API logs the app. You're gone.

[SitaRam @sitaramsaikk]

@RightsHold Agreed. With nested delegation the act claim nests too, so the chain stays recoverable: user, then agent A, then agent B.

Most backends log only the outermost caller. That's where the audit trail breaks.

[SitaRam @sitaramsaikk]

@JesseNotAi Right, and that's also the fix. Put both in the token: sub is the person, act is the agent. Have the backend log both.

Then every write answers two questions: who asked, and which agent did it.

[SitaRam @sitaramsaikk]

"Read-only" users can write through your AI agent. Mine just did. The backend never saw the user, only the agent's shared write-capable service account. One authZ check on the user and the same request failed. Trace every action to the identity the backend accepted.

[SitaRam @sitaramsaikk]

@Jowanza @Muse @bot Common culprits with OAuth MCP servers: the client skipping protected resource metadata discovery (RFC 9728), omitting the resource parameter (RFC 8707), or the server not supporting dynamic client registration.

Worth logging which step Muse fails on.

[SitaRam @sitaramsaikk]

@BoboLinNotes Agree. One addition: test what the tools do, not just what the model says.

Most real damage comes from an agent holding a broad credential, not a clever jailbreak. Good first build: a read-only user writing through an agent tool, then the one check that stops it.

[SitaRam @sitaramsaikk]

@hbukharyy The kill switch item has a catch: it only works if each agent has its own credential.

On a shared service account, revoking the compromised agent takes down the whole fleet. I ran it:
https://t.co/kkvHnR1HyY

[SitaRam @sitaramsaikk]

A kill switch on a shared service account is not a kill switch.

I ran it. One compromised agent.

→ Revoke the shared credential: every agent stops
→ One credential per agent, revoke only Research: the others keep working

Can you kill one agent without taking down the fleet?

[SitaRam @sitaramsaikk]

@jefflunteng Yes. Token exchange (RFC 8693): the agent swaps the user's token for a short-lived one scoped to the task and one audience. Minutes, not days.

On AWS, STS AssumeRole with a session policy does the same.

Bonus: you can revoke one agent without touching the rest.