Every agent deployment we audit passes its own permission review. Each tool is individually scoped, each one justifiable, none of them alarming on their own. Then we chain them. Agent privilege escalation is the discipline of finding the path where a sequence of individually-safe capabilities composes into an authority the designers never granted — read a file, then write a config, then trigger a deploy. In 2026 this is the single highest-severity finding class in our agentic engagements, and it is almost never caught by the permission review that approved the tools in the first place.
Permission Review Is Per-Tool. Attackers Think in Paths.
The mental model that creates the vulnerability is simple: teams evaluate tools one at a time. Is a file-read tool dangerous? No. Is a templating tool dangerous? No. Is a webhook caller dangerous? Not really. Is a deploy trigger dangerous? Yes — so that one gets a confirmation. What nobody evaluates is the graph. The attacker does not need the dangerous tool; they need a path from a tool they can influence to a resource they want. Read a CI config, write a template that lands inside it, let the scheduled job execute it. Three benign capabilities, one privilege escalation, zero individually suspicious calls.
# Escalation chain recovered from an engagement. Each step was an
# approved capability with a documented business justification.
1. read_document(uri) # approved: "agents must read tickets"
-> attacker plants instructions in a ticket
2. write_scratch(path, data) # approved: "agents need working files"
-> instruction steers the write into a watched CI template path
3. [scheduled CI job runs] # approved: "builds must be automatic"
-> the planted template executes with deploy credentials
# Net: read + write + a timer = remote deploy. No single call was
# privileged; the composition was.// BREACH
Incident reference APE-2026-018: An agent with read, scratch-write, and no direct deploy tool reached production anyway. It was induced to write a crafted build template into a path a scheduled job later executed, which ran with deploy credentials the agent never held. Every call passed its own permission check; the escalation lived entirely in the sequence, which no reviewer had modelled.
Detection & Mitigation
First, review the graph, not the tools. Map every path by which a capability the agent can influence reaches a resource that matters, and treat any read-to-write-to-execute chain as a single privileged operation regardless of how benign each hop looks alone. The unit of review is the reachable path, not the individual tool.
Second, break the composition with boundaries the model cannot cross. Isolate the write targets an agent can reach from the paths any executor trusts — an agent that writes scratch files must not be able to write anywhere a scheduler, build, or deploy step will later read. Where a chain must exist, gate its consequential end in code that validates the actual artifact, independent of the agent.
Third, instrument for sequences, not just calls. Alert on capability chains — a read of untrusted content followed by a write into a trusted path followed by an execution — because that pattern is the escalation, and it is invisible to per-call monitoring. This is precisely the path-finding our multi-agent and adversarial-probing engagements exist to run before an attacker does.