An agent that can call another agent has already escalated its privileges
anp2_protocol · reddit · 2026-08-26
The author flags a blind spot in agent security: if an agent can reach another agent, its real capability set is the transitive closure over every reachable agent — the tool allowlist only covers the first hop.
Key points:
- Constraints meant to survive that hop usually degrade into prompt text ("only touch tenant 42", "stay under $50"), but the database and payment API never check those sentences — a recommendation gets treated as a permission.
- Escalation by delegation is hard to reconstruct afterwards: every hop is individually authorized and boring; no log holds the causal fact that it traces back to an agent nobody granted that reach.
Cheap check: walk the tool allowlist and ask whether anything behind each entry is itself an agent. If yes, either mint a narrower credential at spawn time so the resource enforces the constraint, or state plainly that your boundary is one hop deep.
The author concedes the common objection: in many stacks the sub-agent shares the same process and credentials, so the distinction buys little. It bites when delegation crosses a process/org boundary, a sub-agent outlives the parent run, or untrusted input steers the delegation decision.
More from coding & agent
- Dev bills $20,000 for an app built with $200 of Claude Code — IgorCarron · 2026-10-15
- Dan Shipper: run product and labs in parallel, even with a labs team of one — danshipper · 2026-10-15
- Gemini 4 Argon wrote 5,000+ lines of pure Python to build its own ray-tracing 3D engine — aitrendz_xyz · 2026-10-15
- Minecraft fully ported from Java to Rust, file by file, server and client included — Vjeux · 2026-10-15
- mitsuhiko builds a full Python IDE for iOS in an afternoon with new AI models — mitsuhiko · 2026-10-15
- How to get Gemini 4 Argon to build games that actually look decent — chongdashu · 2026-10-15