AI Agent Privilege Escalation: From Chat to Root in Three Steps

How the three-step chain works

Step one is injection: the attacker embeds a malicious instruction in any content the agent retrieves, such as a webpage, a document, or a calendar event. Step two is tool abuse: the injected instruction directs the agent to call a tool with permissions broader than the task requires, such as a file-write tool invoked during a read-only summary task.

Step three is escalation: the over-scoped tool call plants a malicious payload, modifies a configuration, or invokes a system capability the user never intended to grant. On mobile, the gap between an AI feature and device-level access is often just one mis-scoped API permission.

The permission gaps that enable escalation

The research identified a consistent set of misconfigurations that make escalation chains viable.

• Agents granted persistent broad permissions rather than task-scoped, time-limited grants
• No human-in-the-loop confirmation before irreversible or high-impact tool calls
• Tool descriptions that do not restrict the contexts in which a tool may be invoked
• Retrieved content passed directly to the agent without stripping embedded instructions
• Missing sandboxing between agent tool execution and OS-level capabilities

How RASMISER audits agentic permission models

RASMISER inspects how your app scopes agent permissions, where confirmation gates are absent before sensitive tool calls, and which tool invocation paths can be triggered by untrusted retrieved content, with every finding mapped to OWASP MASVS.

With runtime protection active, agent tool calls to sensitive APIs are instrumented and tamper-resistant, so an injected instruction attempting to escalate hits a hard boundary rather than executing silently.