Agent Impersonation

An attacker extracts a long-lived API key from environment variables, configuration files, or logs and reuses it to authenticate as the legitimate agent. Bearer tokens in the Authorization header provide no proof-of-possession, making them vulnerable to replay if intercepted.

• Common exfiltration paths: .env files committed to repositories, CI/CD pipeline logs, compromised developer workstations
• Mitigation: Enforce Demonstration of Proof-of-Possession (DPoP) tokens that bind the credential to a specific client key pair
• Real-world impact: Attackers pivot from a single leaked key to full agent impersonation across all services trusting that identity

An adversary crafts a JSON Web Token signed with a symmetric algorithm (HS256) using the server's public key as the secret, while the server expects asymmetric signing (RS256). The verifier, confused by the alg header, accepts the forged token.

• Attack surface: Any endpoint accepting JWTs without pinning the expected algorithm per key
• Critical failure: Libraries that use the alg parameter from the untrusted header to select verification logic
• Defense: Explicitly whitelist allowed algorithms per key ID (kid), never trust the client-supplied alg field

When a trusted Certificate Authority (CA) is breached, attackers can issue valid X.509 certificates for any domain. In mutual TLS (mTLS) agent networks, this enables perfect impersonation of any agent identity.

• Historical precedent: DigiNotar (2011) breach led to fraudulent *.google.com certificates used in MITM attacks against Iranian users
• Agentic impact: A rogue intermediate CA can sign leaf certificates that pass full chain validation in SPIFFE-based workload identity systems
• Mitigation: Implement certificate transparency monitoring and pin trusted root CAs per agent trust domain

On Windows-based agent hosts, a compromised service with SeImpersonatePrivilege can assume the security context of any authenticated user or service account. Attackers exploit named pipe connections to coerce privileged token creation.

• Technique: The Potato family of exploits (Rotten, Juicy, PrintSpoofer) triggers SYSTEM-level authentication to a controlled endpoint
• Agent risk: A containerized agent running with this privilege can escape its context and impersonate the orchestrator
• Hardening: Remove SeImpersonatePrivilege from agent service accounts; use group Managed Service Accounts (gMSA) for automated password rotation

In SPIFFE-based identity systems, the SPIRE agent on each node attests to its identity before receiving SVIDs (SPIFFE Verifiable Identity Documents). If the node attestation plugin is misconfigured, an attacker can register a rogue node and obtain valid workload identities.

• Attack vector: Weak attestation relying solely on IP address or hostname that can be spoofed
• Consequence: The attacker's agent receives cryptographically valid SVIDs trusted by the entire mesh
• Defense: Use hardware-backed attestation via TPM or Intel SGX for node identity verification; never rely on network-level attributes alone

An attacker launches a legitimate agent process in a suspended state, unmaps its memory, and replaces it with malicious code. The hollowed process retains the original executable's identity, digital signature, and parent-child process relationships.

• Detection gap: The process appears legitimate in task managers and endpoint detection tools because the image path and signature are unchanged
• Agent-specific risk: A hollowed agent process inherits all existing authentication tokens, environment variables, and network connections
• Mitigation: Monitor for process creation with CREATE_SUSPENDED flag followed by memory unmapping (NtUnmapViewOfSection); deploy VBS-protected credential isolation

Implement bidirectional certificate verification where both the client agent and server agent present X.509 certificates. This eliminates the possibility of a rogue agent injecting itself into the communication stream.

• Requires a robust Public Key Infrastructure (PKI) for automated certificate issuance and revocation
• Binds agent identity to a cryptographic key pair, not a spoofable IP address or API key
• Critical for Zero Trust Architecture (ZTA) in agent mesh networks

Example: An orchestrator agent refuses a task submission from a worker agent that cannot present a certificate signed by the internal root CA.

Require agents to cryptographically prove their execution environment integrity before joining the network.

• Leverages Trusted Platform Module (TPM) or Intel SGX to generate a signed quote of the agent's boot state and running code
• A remote verifier checks the quote against a known-good Platform Configuration Register (PCR) baseline
• Detects Process Hollowing, DLL Side-Loading, or kernel-level rootkits that have tampered with the agent binary

This ensures the agent is not just presenting the correct identity, but is also running unmodified code in a trusted state.

Move beyond single-factor, point-in-time authentication to continuous verification of agent identity based on behavioral patterns.

• Monitor inter-agent communication cadence, API call sequences, and resource access patterns
• Detect Agentic Behavioral Drift that indicates an impersonator has replaced the legitimate agent
• Use machine learning models to establish a baseline of normal agent behavior and flag deviations

Example: A payment agent that suddenly starts querying the HR database or communicating with an unknown external IP triggers an immediate session revocation.