{"slug": "account-takeover-via-valid-permissions-a-proof-of-concept", "title": "Account Takeover via Valid Permissions: A Proof of Concept", "summary": "A proof-of-concept demonstrates that AI agents with valid individual permissions can execute account takeover through a sequence attack, where per-call checks fail to detect the malicious composition. The researcher's reproduction script shows that tracking prior action classes, such as IDENTITY_MUTATION followed by CREDENTIAL_RECOVERY, can block the attack even when each step is individually allowed.", "body_md": "# Account Takeover via Valid Permissions: A Proof of Concept\n\nI've been testing this \"sequence attack\" logic with my team. We found that most deployment patterns rely on per-call checks: \"Does the agent have the `update_email`\n\npermission? Yes. Does it have `send_password_reset`\n\n? Yes.\" The result is a successful account takeover despite 100% green checks.\n\nIf you want to see this in action without the fluff, you can run this reproduction script. It uses only the Python standard library—no network calls, no API keys, just pure logic.\n\n```\ngit clone https://github.com/keniel13-ui/sequence-attack-repro\ncd sequence-attack-repro && python3 repro.py\n```\n\n## The Failure of Step-Only RBAC\n\nIn a real-world AI workflow, an agent might handle a support ticket. If the ticket says \"change my email to [[email protected]](/cdn-cgi/l/email-protection) and reset my password,\" a basic system sees:\n\n`read_ticket`\n\n-> ALLOWED`read_customer`\n\n-> ALLOWED`update_contact_email`\n\n-> ALLOWED`send_password_reset`\n\n-> ALLOWED\n\nEverything is within the agent's role, yet the account is gone. Prompt injection classifiers might catch some of this, but the core issue is architectural.\n\n## Solving for Composition\n\nThe real challenge is when the caller is verified and the purpose is legitimate (e.g., `account_recovery`\n\n). In these cases, the agent *should* be able to read data and change identity details. The security failure happens at the **composition** level.\n\nThe goal is to move from \"Is this tool allowed?\" to \"Is this sequence of tools allowed?\" In the provided repo, the system blocks the final step not because the tool is forbidden, but because of the `prior_action_classes`\n\n.\n\nHere is how the system logs the block when it detects a sequence attack:\n\n```\n{\n \"tool\": \"send_password_reset\",\n \"args\": { \"id\": \"cust_77\" },\n \"action_class\": \"CREDENTIAL_RECOVERY\",\n \"grant\": {\n \"principal\": \"caller_claiming_cust_77\",\n \"purpose\": \"account_recovery\",\n \"verified_via\": \"callback_verified\"\n },\n \"facts_in_chain\": [],\n \"prior_action_classes\": [\"READ\", \"IDENTITY_MUTATION\"],\n \"decision\": { \"allow\": false, \"rule\": \"R4_SEQUENCE\" },\n \"why\": \"credential recovery after an identity mutation in the same session composes to account takeover. Every step was allowed. The sequence was the attack.\",\n \"chain_sha256\": \"726f65973fb027640049120971a43ca68300197d56ab2d74d5ca94a977d907a7\"\n}\n```\n\nBy tracking `prior_action_classes`\n\n, the gate recognizes that `IDENTITY_MUTATION`\n\nfollowed by `CREDENTIAL_RECOVERY`\n\nis a high-risk pattern, regardless of whether the individual permissions are green. This is a much more robust approach for any production LLM agent deployment.\n\n[Next Bare-Metal Kubernetes: My $200 Scrap Hardware Build →](/en/threads/3395/)", "url": "https://wpnews.pro/news/account-takeover-via-valid-permissions-a-proof-of-concept", "canonical_source": "https://promptcube3.com/en/threads/3421/", "published_at": "2026-07-25 23:02:07+00:00", "updated_at": "2026-07-25 23:35:42.939666+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-research"], "entities": [], "alternates": {"html": "https://wpnews.pro/news/account-takeover-via-valid-permissions-a-proof-of-concept", "markdown": "https://wpnews.pro/news/account-takeover-via-valid-permissions-a-proof-of-concept.md", "text": "https://wpnews.pro/news/account-takeover-via-valid-permissions-a-proof-of-concept.txt", "jsonld": "https://wpnews.pro/news/account-takeover-via-valid-permissions-a-proof-of-concept.jsonld"}}