Least Privilege Was Hard Enough With Humans. Now Your Agents Delegate to Each Other.

In August 2025, attackers stole the OAuth tokens belonging to a single chatbot integration, Salesloft’s Drift, and used them to reach more than 700 organisations in about ten days. Not small companies. Cloudflare, Zscaler, Palo Alto Networks, security vendors whose entire business is keeping data safe. The attackers didn’t break a password or trip an alarm. The tokens were valid, so to every system they touched it looked like the chatbot doing its job. They walked through hundreds of Salesforce environments and combed the exported data for more secrets, AWS keys, VPN credentials, anything that opened the next door.

Sit with the shape of that. One automated integration, granted broad access so it could be useful, became the single key that unlocked 700 companies. That’s not a story about a clever exploit. It’s a story about what happens when you give a non-human thing more access than it needs and then someone takes it.

An agent is an identity aggregation point, and that’s the problem

You have spent your career getting least privilege right for people. Joiners, movers, leavers. Standing permissions trimmed back. The principle that nobody should hold more access than their job requires. It was hard, it was thankless, and most of us are still not fully there with humans.

Agents detonate that work, because an agent is something we’ve never had to govern at scale before: an aggregation point for many identities at once. A single agent might hold credentials for your cloud provider, your email, your code repository, your ticketing system, and half a dozen SaaS tools, all so it can be helpful across them. Each of those grants might individually pass a least-privilege review. The aggregate is a blast radius no service account was ever designed to have. Compromise the agent, and you don’t inherit one permission. You inherit all of them, at once, at machine speed.

And unlike a human, the agent can be talked into misusing what it holds. This is the confused deputy problem, a concept from 1988 that AI has dragged back into daily relevance: a privileged program tricked by a less-privileged party into misusing its authority. In June 2026 a Meta AI support bot showed the modern version, it held the power to change account settings and reset passwords, but lacked the judgment to verify that the person asking was entitled to ask. It had the keys and not the wariness. An attacker doesn’t need to steal an agent’s credentials if they can simply persuade the agent to use them.

Then the agents start delegating to each other

Everything above is true for one agent. The DeepMind paper on intelligent delegation points at what happens when agents hand work to other agents, and this is where it stops resembling anything you’ve governed before.

When an agent sub-delegates a task, the naive implementation passes along its access so the sub-agent can get the job done. The paper’s term for the discipline you need instead is privilege attenuation: an agent that delegates must pass on only the strict subset of authority required for that specific sub-task, never its full set. Get this wrong and a permission you granted agent A for one narrow purpose flows to agent B, then C, agents you never evaluated, expanding quietly with every hop. A read-only agent that hands its task to a downstream agent connected to a public channel has just become a data-exfiltration path, even though every individual link looked harmless. Your effective permission surface is no longer something you can read off one agent’s config. It’s the sum of the whole chain, and the chain assembles itself at runtime.

The principles haven’t changed. The blast radius and the speed have.

Here’s the reassuring part, and the sobering part, in one sentence: none of the answers are new to you.

This is Zero Trust, least privilege, and separation of duties, the disciplines you already preach.

What’s changed is that the actors are autonomous, they multiply, they delegate, and they move faster than you can watch. So the old principles need sharper teeth.

• Give every agent its own scoped, short-lived, task-bound identity. Not an inherited human session, not a shared service account, not a long-lived API key sitting in a config file. The Salesloft lesson is that a standing, broadly-scoped credential is a permanent invitation. High-stakes access should be granted just in time, scoped to the immediate task, and expire when the task ends. An agent that needs database access for one job gets it for one job, not forever.
• Enforce the intersection, not the agent’s own permissions. The sharpest rule emerging from agent security is this: an agent acting for a user must be limited to the intersection of what the agent is allowed to do and what that user is allowed to do. If the user can’t delete the record, the agent acting on their behalf must fail when it tries, no matter what the agent’s role technically permits. Without this rule, a manipulated agent borrowing an admin’s session is an admin.
• Attenuate on every hand-off, and be able to revoke the whole chain instantly. When an agent sub-delegates, it must pass the minimum slice of authority, restricted to the specific operation, the specific data, read-only where possible, not a copy of its own keyring. And you need an algorithmic circuit breaker: the moment an agent’s trust signal drops or anomaly detection fires, every token it holds and every token it has passed downstream gets invalidated at once. Define these rules as policy-as-code so you can audit and version them, because at this scale you cannot manage permissions by hand.

The uncomfortable truth is that you’re about to relearn access control under harder conditions than you’ve ever faced. With humans, an over-permissioned account is a risk that sits there. With agents, an over-permissioned identity delegates, aggregates, and gets persuaded, and one stolen token can become 700 companies in ten days.

The question to put to any agentic system before it touches your environment is simple, and most vendors can’t yet answer it well: when this agent hands work to another agent, exactly what can it pass along, and can you take it all back the instant something looks wrong?