Findings/broad-credentials-amplify-injection

An agent holding broad credentials turns one injected instruction into access to everything those credentials reach.

Corroboratedmeasured5 evidence records from 5 independent sourcesassistant-drafted

Scope: what this does not show

Demonstrations on specific products; the principle is general.

Corroborated: Supported by at least two independent sources.

Evidence

May 26, 2025

Invariant Labs shows GitHub MCP agents can be steered by a public issue to leak private repo data

Invariant Labs

Jun 11, 2025

EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)

arXiv

Jul 8, 2025

General Analysis shows Supabase MCP with service-role access leaking tables via a support ticket

General Analysis

Sep 25, 2025

ForcedLeak: Web-to-Lead prompt injection could make Salesforce Agentforce leak CRM data

Noma Security

Nov 19, 2025

AppOmni shows second-order prompt injection recruiting privileged ServiceNow Now Assist agents

AppOmni

Key questions that rely on this finding

Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.

Status history

2025-05-26ReportedA broadly scoped GitHub token let an injected issue expose private repositories. · record
2025-06-11CorroboratedEchoLeak shows the same pattern in Microsoft 365 Copilot. · record

What would change this: Evidence that least-privilege scoping is routine in deployed agents.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 311d old · recheck in 419 daysNewest evidence Nov 19, 2025. Half-life 730 days.
Methods tested: Restricting what agents can reach Credential overreach Indirect prompt injection
Topics: Tools & MCP Data exfiltration
Attack surface: Credentials Tools & MCP
Fide research: FID-076: Authorization boundaries and AI control in cybersecurity

Cite this record

Fide AI. "An agent holding broad credentials turns one injected instruction into access to everything those credentials reach.." Agentic Cyber Explorer, record broad-credentials-amplify-injection. https://agentic-cyber-explorer.pages.dev/findings/broad-credentials-amplify-injection/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-broad-credentials-amplify-injection,
  author = {{Fide AI}},
  title = {An agent holding broad credentials turns one injected instruction into access to everything those credentials reach.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/broad-credentials-amplify-injection/},
  note = {Record broad-credentials-amplify-injection; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.