AI-AGENT-MULTIPrivilege Escalation

Multi-Agent Collusion / Confused Deputy

Specialist sub-agents trust each other's outputs implicitly — injection into one (browser agent) propagates to a more privileged one (shell agent).

§ Where this technique fits

AI-AGENT-MULTI is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Multi-agent confused-deputy → tool-call escalation
User-facing agent has limited tools; back-end planning agent has powerful tools (shell, file system). Prompt injection in user input → user agent → back-end agent. The back-end runs the attacker's intent under the planner's higher trust.
step 2 / 6

§ What commonly comes next

01
Indirect Prompt Injection (RAG / Web)
AI-INDIRECT-INJECT · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Multi-agent confused-deputy → tool-call escalation

§ What commonly comes next