AI Agent Identity Impersonation

An attacker impersonates a trusted AI agent or manipulates agent identity signals to gain unauthorized trust, issue delegated instructions, invoke connected tools, access protected resources, or influence other agents and enterprise workflows.

AI Agent Identity Impersonation targets a fundamental requirement of agentic systems:

How does one system know which agent it is actually communicating with?

As enterprises deploy multiple agents, those agents increasingly communicate with other agents, APIs, MCP servers, applications, orchestration platforms, and enterprise resources.

Organizations may assign different capabilities and levels of trust to different agents.

That creates an identity problem similar to human and workload identity management, but with an additional layer of autonomous delegation.

If agent identity is represented only through a name, metadata field, caller-controlled identifier, session value, API parameter, or other weak signal, an attacker may be able to impersonate a more trusted agent.

The receiving system may then authorize actions because it believes the request originated from an approved AI identity.

The resulting attack path is:

Attacker → Spoof Trusted Agent → Inherit Trust → Invoke Capability → Reach Protected Resource

This becomes particularly dangerous in multi-agent environments where one agent’s identity determines whether another agent accepts its instructions.

An attacker identifies an enterprise environment where AI agents communicate with one another or with connected systems.

The attacker determines how agent identity is established.

This may involve:

• API credentials
• OAuth tokens
• Workload identities
• Agent identifiers
• MCP sessions
• Service accounts
• Certificates
• Message metadata
• Orchestration context
• Application-generated claims

The attacker then attempts to spoof, steal, replay, substitute, or otherwise manipulate the identity of a trusted agent.

A receiving agent or enterprise service interprets the malicious request as originating from the trusted AI identity.

If authorization is tied to that identity, the attacker may gain access to capabilities unavailable through their own account or agent.

This can become even more significant when trusted agents are allowed to delegate tasks to other agents.

1. Agent Discovery
The attacker identifies agents operating within the target environment.

2. Trust Mapping
Relationships between agents, tools, APIs, and enterprise resources are analyzed.

3. Identity Mechanism Discovery
The attacker determines how trusted agent identity is represented and verified.

4. Identity Manipulation
Credentials, tokens, metadata, identifiers, messages, or session information are spoofed, stolen, replayed, or substituted.

5. Agent Impersonation
The attacker presents a request appearing to originate from the trusted agent.

6. Trust Acceptance
The receiving system accepts the claimed identity.

7. Privileged Interaction
The impersonated identity accesses tools, data, workflows, or other agents.

8. Delegated Expansion
Additional capabilities may become available through downstream trust relationships.

9. Objective Execution
The attacker performs unauthorized actions using the trust assigned to the impersonated agent.

• Enterprise AI agents
• Multi-agent systems
• Agent orchestration platforms
• MCP-enabled environments
• Agent-to-agent protocols
• AI workflow systems
• SaaS-connected agents
• Cloud AI platforms
• Service accounts
• Workload identities
• OAuth-enabled agents
• API-connected agents
• Coding agents
• Security automation agents
• IT operations agents
• Financial workflow agents
• Customer-service agents

Enterprise security has spent decades building identity controls around people, applications, devices, and workloads.

AI agents introduce another identity class.

An enterprise may eventually operate hundreds or thousands of agents, each possessing different tools, permissions, responsibilities, and levels of trust.

If organizations cannot reliably establish which agent is requesting an action, authorization decisions built on top of those identities become unreliable.

A successful impersonation could allow an attacker to:

• Access protected enterprise information
• Invoke privileged tools
• Manipulate business workflows
• Influence other AI agents
• Perform administrative actions
• Abuse trusted service accounts
• Cross tenant boundaries
• Hide malicious activity behind a legitimate AI identity

For enterprise AI security testing, the critical question becomes:

Can an attacker convince your environment that they are a trusted AI agent and inherit the authority assigned to that agent?

That belongs directly in an offensive assessment of multi-agent systems.

Authorized testing should determine whether agent identity can be trusted independently of the content the agent provides.

Testing should include:

• Agent-ID spoofing
• Caller-controlled identity fields
• Message-origin manipulation
• Token replay
• Expired-token reuse
• Stolen agent credentials
• Cross-agent credential reuse
• Service-account impersonation
• OAuth token substitution
• Audience and scope validation
• Agent certificate validation
• MCP identity handling
• Session-binding tests
• Cross-tenant agent impersonation
• Agent registration abuse
• Duplicate agent-name creation
• Trust after credential revocation
• Delegated-agent identity propagation
• Multi-hop identity preservation
• Unauthorized agent enrollment
• Identity changes during active workflows

Testing should map:

Human → Agent → Agent → Tool → Resource

and verify that the initiating identities remain attributable throughout the entire chain.

A particularly important test is whether changing something as simple as an agent identifier or message metadata causes the receiving system to grant additional trust.

Monitor for:

• Duplicate agent identities
• Unexpected agent registrations
• Agent credentials used from unusual systems
• Token reuse
• Authentication from unexpected environments
• Agent identity changes during sessions
• Privileged requests from newly created agents
• Agent messages failing signature validation
• Service-account anomalies
• Unusual OAuth token usage
• Cross-tenant agent identity collisions
• Multiple agents presenting the same identity
• Actions without traceable initiating identities
• Sudden changes in agent communication patterns
• Privileged tool calls from unexpected agent identities
• Revoked identities continuing to operate

AI Agent Identity Impersonation is an agent-specific identity attack rather than one conventional ATT&CK technique. Depending on implementation, relevant techniques may include: T1078 — Valid Accounts T1528 — Steal Application Access Token T1550 — Use Alternate Authentication Material T1134 — Access Token Manipulation T1098 — Account Manipulation MITRE ATLAS should additionally be considered for AI-specific adversarial behavior.

OWASP Mapping Strongly related to agentic risks involving: Identity & Privilege Abuse Tool Misuse & Exploitation Agentic Supply Chain Vulnerabilities Multi-Agent Trust Exploitation This record is distinct from Cross-Agent Trust Exploitation. RB-044 asks: Can a legitimate but compromised agent abuse another agent's trust? RB-050 asks: Can an attacker falsely convince the environment that they are the trusted agent?