Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Multi-agent confused-deputy → tool-call escalation

User-facing agent has limited tools; back-end planning agent has powerful tools (shell, file system). Prompt injection in user input → user agent → back-end agent. The back-end runs the attacker's intent under the planner's higher trust.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target deploys an agent stack with role specialisation — front-end agent talks to user, back-end planner / executor with broader tool surface. The two agents trust each other's outputs without re-authorising.

§ Steps

  1. 01
    Tool output exfils host secretsExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Code-exec on agent hostExecution
    T1059— Command and Scripting Interpreter
  3. 03
    Send injection payload to user agentInitial Access
    AI-PROMPT-INJECT— Direct Prompt Injection
  4. 04
    Planner trusts relayed content as user intentInitial Access
    AI-INDIRECT-INJECT— Indirect Prompt Injection (RAG / Web)
  5. 05
    Planner invokes shell / fs toolExecution
    AI-TOOL-ABUSE— Tool / Function-Call Abuse
  6. 06
    User agent relays to planner agentPrivilege Escalation
    AI-AGENT-MULTI— Multi-Agent Collusion / Confused Deputy

§ References

§ Frequently asked

What is the "Multi-agent confused-deputy → tool-call escalation" attack path?
User-facing agent has limited tools; back-end planning agent has powerful tools (shell, file system). Prompt injection in user input → user agent → back-end agent. The back-end runs the attacker's intent under the planner's higher trust. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Tool output exfils host secrets (T1041) — a exfiltration primitive. Assumed environment: target deploys an agent stack with role specialisation — front-end agent talks to user, back-end planner / executor with broader tool surface.
What is the final impact of this kill-chain?
The final step lands on User agent relays to planner agent (AI-AGENT-MULTI), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers