Agent tool accepts unauthorized object or tenant parameters
A tool trusts caller-supplied object or workspace identifiers instead of enforcing the authenticated principal’s authority.
Candidate CWE: CWE-863
Test hypothesis#
As A, call the local tool with A’s owned object, then B’s synthetic object while holding credentials constant. Repeat directly through the tool adapter to locate backend authorization independently of prompting.
Evidence required#
A/B ownership records, authenticated principal, accepted arguments, server decision and B canary or protected state change.
Rule out false positives#
Shared objects or deliberately delegated connector access can legitimately cross apparent workspace boundaries.
Playbook and command references#
- AI tools: input trust, execution identity and approvals — Prove when lower-trust content changes a protected tool action, then locate the missing authorization or consent boundary.
- Object, function, and property authorization — Turn identities, tenants, objects, roles, and lifecycle transitions into a reproducible permission matrix.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.