Overview
AI identity security focuses onapplication-layer role setting and permission boundariesreliability. Unlike prompt-jailbreak (which targets model safety alignment), the goal of identity security testing is to verify whether the role restrictions, permission assignments, session isolation, and credential control granted to AI by the business can be bypassed. Once an Agent gains tool invocation and external system access capabilities, the impact of identity loss of control escalates from "saying things it shouldn't say" to "doing things it shouldn't do."
Attack surface overview
| Attack category | Sub-attack | GAARM ID |
|---|---|---|
| Role escape | Assumed scenario / assumed role / forgetting method / goal hijacking | 0052.001-004 |
| Permission loss of control | Action module privilege escalation / unauthorized MCP resource acquisition / account privilege escalation | 0053/0057/0058 |
| Identity forgery | Session token theft / Agent identity impersonation / trust chain deception | 0059 |
| Session and credentials | Session hijacking / cache deception / API Key leakage | 0055/0056 |
In-depth reference
- Detailed test Payloads, attack chains, and detection methods for each attack category → references/identity-attack-techniques.md
Phase 0: Identity architecture reconnaissance
- Identify the Agent authentication method (API Key / OAuth / Session Token / no authentication)
- Enumerate the permission model (RBAC / ABAC / no explicit permission control), and confirm how role setting is implemented (system prompt / code logic / configuration file)
- Probe the session management mechanism (session ID generation method, expiration policy, degree of cross-session isolation)
Phase 1: Role escape testing (GAARM.0052)
- Assumed scenario escape: Construct a confusing scenario to make the model deviate from its work objective, and combine keyword localization to attempt to leak system settings
- Assumed role escape: Ask the model to play a specific role (DAN / developer mode), causing it to ignore application-layer role restrictions
- Forgetting method escape: Induce the model to "forget" previous role instructions and reset to an unconstrained state
- Goal hijacking: Through manipulation, make the AI deviate from its original role setting to perform the task desired by the attacker
Boundary between role escape and jailbreak: jailbreak attacks the model's safety alignment (making the model generate harmful content), while role escape attacks the application's business role setting (making a customer service Bot perform administrative operations). The two can be used in combination, but the testing objectives differ.
Phase 2: Permission loss of control testing (GAARM.0053/0057/0058)
- Action module privilege escalation: Through prompt injection or parameter tampering, trigger the Agent to execute an Action beyond its authorization scope (such as replacing an ordinary query operation with an administrative operation)
- Unauthorized MCP resource acquisition: Test whether there are flaws in MCP Server permission verification, and whether a malicious Server can bypass permission checks to access system resources (see
mcp-security） - Account privilege escalation: Verify whether the Agent can access data across accounts in a multi-tenant scenario
Phase 3: Multi-Agent identity forgery (GAARM.0059)
- Session Token Theft: Inducing an Agent through Prompt Injection to output session credentials or send them to an external endpoint
- Agent Identity Spoofing: Forging messages from a high-privilege Agent in a multi-Agent system to deceive the target Agent into performing unauthorized operations
- Trust Chain Deception: Exploiting implicit trust relationships between Agents to indirectly control a high-privilege Agent by compromising a low-privilege Agent
Phase 4: Session and Credential Security (GAARM.0055/0056)
- Session Hijacking: Testing the predictability, fixity, and transmission security of session IDs
- Cache Deception: Verifying whether CDN/proxy caches may leak responses containing authentication information
- API Key Leakage: Checking whether credentials in the Agent configuration can be induced to be output through Prompt Injection
Detection Checklist
1. [ ] 身份架构已侦察？认证方式、权限模型、会话管理机制已明确？
2. [ ] 角色逃逸：假定场景/角色/遗忘法/目标劫持是否能突破角色设定？
3. [ ] 权限失控：Action 参数是否可被篡改？MCP 权限验证是否完整？
4. [ ] 身份伪造：多 Agent 间消息来源是否经过验证？信任链是否可被利用？
5. [ ] 会话安全：会话 ID 是否安全生成？是否存在固定会话攻击面？
6. [ ] 凭据管控：API Key 和 Token 是否可通过注入被泄露？
7. [ ] 跨租户隔离：多租户场景下数据访问边界是否可靠？