An agent that can call another agent has already escalated its privileges
anp2_protocol · reddit · 2026-08-26
The author flags a blind spot in agent security: if an agent can reach another agent, its real capability set is the transitive closure over every reachable agent — the tool allowlist only covers the first hop.
Key points:
- Constraints meant to survive that hop usually degrade into prompt text ("only touch tenant 42", "stay under $50"), but the database and payment API never check those sentences — a recommendation gets treated as a permission.
- Escalation by delegation is hard to reconstruct afterwards: every hop is individually authorized and boring; no log holds the causal fact that it traces back to an agent nobody granted that reach.
Cheap check: walk the tool allowlist and ask whether anything behind each entry is itself an agent. If yes, either mint a narrower credential at spawn time so the resource enforces the constraint, or state plainly that your boundary is one hop deep.
The author concedes the common objection: in many stacks the sub-agent shares the same process and credentials, so the distinction buys little. It bites when delegation crosses a process/org boundary, a sub-agent outlives the parent run, or untrusted input steers the delegation decision.
More from coding & agent
- Ollama v0.33 released with one-click Claude Desktop integration — mchiang0610 · 2026-08-26
- Ollama details Claude integration: zero data retention policy — ollama · 2026-08-26
- T3 Code releases an agent and model selector combo — op7418 · 2026-08-26
- Shipping your first iOS app with Replit: A developer's POV — billyjhowell · 2026-08-26
- Claude-built prompt templating system mass-generates ComfyUI workflows; 5-min video re-renders in 2 hours — spikyness27 · 2026-08-26
- LangChain Founder: Deepagents Evolving into Multiplayer Harness — hwchase17 · 2026-08-26