HOME / SERVICES / AI SECURITY / OWASP TOP 10
ASI03 - IDENTITY AND PRIVILEGE ABUSE
Something changed 4,000 customer records overnight. The audit trail names a service account. That account is used by three agents, two integrations and a scheduled job, and its key was issued in 2023 by a person who has since left. AI agent identity and access management is now a POPIA accountability question in South Africa, not merely an operational one, because you cannot demonstrate accountability for an action you cannot attribute. ASI03 is the third entry in the OWASP Top 10 for Agentic Applications, published 9 December 2025 by the OWASP Agentic Security Initiative. Arkose Labs found in February 2026 that only 26% of enterprises are very confident they could prove an AI agent was involved in an incident. That survey had no African respondents.
YOUR LOGS SAY THE SERVICE ACCOUNT DID IT. THAT IS NOT AN ANSWER.
DEFINITION
WHAT THIS RISK ACTUALLY IS
Identity systems were built around a person. A person has a joining date, a manager, a role, a leaving date and a disciplinary process. Every access model you own inherits those assumptions.
An agent has none of them. It is created by a developer, given a credential, and left running. It does not leave. It does not get reviewed at quarter end. It frequently holds an identity that was sized for convenience during a proof of concept and never resized for production.
Identity and privilege abuse covers what follows from that.
DOCUMENTED CASE
WHAT IT LOOKS LIKE IN PRACTICE
The documented case is the Salesloft Drift compromise of August 2025. Attackers stole OAuth and refresh tokens belonging to an AI chat agent and used them to reach connected customer relationship systems. Fourteen companies publicly confirmed impact.
- Step by step.
- 01 - The agent was integrated with customer systems in the ordinary way. To work, it held OAuth access tokens and refresh tokens for those systems, issued during setup and stored for reuse.
- Attackers obtained those tokens.
- 02 - They then used them exactly as the agent would have. The requests were properly authenticated. They carried valid credentials, arrived from an expected integration, and matched an established pattern of access.
- They reached connected customer relationship data.
- 03 - The model was never touched. No prompt was manipulated, no jailbreak was attempted, and no AI-specific control would have made any difference. The failure was token hygiene and third-party integration visibility.
- That is the point worth taking to your board. The most consequential agent identity incident published to date was a credential management failure with an AI agent attached to it. The controls that would have limited it are unglamorous: short-lived tokens, scoped grants, an inventory of which integrations hold which credentials, and alerting on token use that does not match the agent's normal behaviour.
WHAT THIS MEANS UNDER SOUTH AFRICAN LAW
DISCOVERY
NEWORDER connects to CI/CD pipelines to automatically discover and inventory every homegrown AI application, and integrates directly with AWS Bedrock, Google Vertex AI, Salesforce, and other cloud and third-party platforms for visibility into AI agents. Each AI system is profiled across its model, system prompt, tools, guardrails, policies, and configurations, and the inventory stays current on every change. You cannot secure what you cannot see; discovery is the non-negotiable first step.
AI SECURITY POSTURE MANAGEMENT (AI-SPM)
NEWORDER conducts a static analysis of every application’s configuration, policy coverage, and third-party dependencies and identifies any policy gaps. In addition, it maps each agentic application to its coverage of major frameworks, including NIST, OWASP, and MITRE. This gives you a clear, measurable view of your AI security posture before a single adversarial test is run, turning assumptions into evidence and compliance into a continuous output rather than a periodic exercise.
AI RED TEAMING
NEWORDER’s automated AI red teaming covers the complete kill chain from reconnaissance to exploitation. It proactively discovers exploitable vulnerabilities through automated reconnaissance and adversarial testing purpose-built for agentic applications. Static attacks draw from a 300K+ payload library with 100% MITRE and OWASP LLM and Agentic Top 10 coverage, running comprehensive sweeps of known jailbreak patterns, content moderation bypasses, and obfuscation techniques. Dynamic attacks use multi-turn and continuous probing to test how an application holds up across extended adversarial sequences, not just a single interaction. High-agency attacks deploy extremely customised, bespoke attack techniques through probing tailored specifically to the intent and design of each application.
RUNTIME PROTECTION
NEWORDER offers policy enforcement and AI threat protection at the proxy, API, or AI Gateway layer. Protection adapts as the applications evolve and as new capabilities are added. When an attack hits production, whether a jailbreak, a prompt injection, or any other AI threat, it is blocked in real time and an immediate alert is sent with full context, including what happened, which application was targeted, what the impact is, and what to do next. Key performance metrics include 98.6% threat detection accuracy, 1.4% false positive rate, sub-200ms time to detect, sub-50ms real-time blocking, and immediate mean time to respond.
POPIA section 19
The responsible party must secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures, including preventing unlawful access. A shared, non-expiring credential held by several agents is neither appropriate nor reasonable, and it will not read as reasonable to a regulator reviewing it after the fact.
POPIA section 21
Where an operator processes personal information on your behalf, you must have a written contract requiring them to establish and maintain the security measures in section 19. An operator processing on your behalf does not transfer your liability. The tokens sit with them. The obligation stays with you.
POPIA section 22
Notification of a compromise goes to the Information Regulator and to the affected data subjects, and it must describe the personal information affected. You cannot scope that notification if you cannot attribute the access. Broken attribution converts a contained incident into an over-broad notification, or into a late one, and both are worse for you.
POPIA section 71
Decisions based solely on automated processing that have legal consequences for a person, or substantially affect them, are restricted. Section 71 assumes you can identify which decisions were automated. When agents share identities with scheduled jobs and integrations, you cannot separate the automated decisions from the human ones, so you cannot evidence compliance either way.
King V
, effective for financial years beginning on or after 1 January 2026. The governing body must ensure demonstrable accountability for decisions, actions, outputs and outcomes arising from technology, with human oversight and override proportionate to risk, and periodic assurance. Demonstrable is the operative word. An action attributed to a shared service account is not demonstrably accountable to anyone, so King V is failed at the logging layer, before any question of ethics or intent arises.
Joint Standard 2 of 2024
, in force 1 June 2025 for banks, insurers, asset managers, retirement funds and credit rating agencies. The board is ultimately accountable under a board-approved cyber risk charter, documented evidence of control testing is required, and material incidents may need to reach the FSCA or Prudential Authority within 24 hours. A 24 hour notification obligation is an attribution obligation. Set against the Arkose Labs finding of February 2026 that only 26% of enterprises are very confident they could prove agent involvement in an incident, most institutions would currently be reporting uncertainty rather than facts.
Cybercrimes Act 19 of 2020, section 2
Access to data by means of a stolen credential is unlawful access, whether the credential belonged to a person or to an agent. A token is a credential. Nothing in the Act treats a machine identity as a lesser one.
QUESTIONS TO ASK BEFORE YOUR NEXT AGENT GOES LIVE
- Does this agent have an identity that no other agent, integration or scheduled job uses, and can we prove that?
- Who is the named human owner of this credential, and what happens to it on the day that person leaves?
- When an agent acts for a customer or an employee, does the downstream system record the person or only the agent?
- What is the shortest credential lifetime this agent can operate on, and why is the current one longer?
- If we had to revoke every credential this agent holds in the next fifteen minutes, who does it, and has that been rehearsed?
- Could we prove, from logs alone, that an agent was involved in a specific incident, in the format POPIA section 22 and Joint Standard 2 will ask for?
FREQUENTLY ASKED QUESTIONS
FAQ
What is identity and privilege abuse in agentic AI?
It is ASI03 in the OWASP Top 10 for Agentic Applications, published 9 December 2025. It covers agents sharing service accounts, holding standing high privilege, losing the human identity when they call downstream systems, and holding long-lived credentials nobody owns or rotates. The result is action that cannot be attributed to a person, which is an accountability failure before it is a technical one.
Why does agent attribution matter for POPIA compliance?
POPIA section 22 requires notification to the Information Regulator and to affected data subjects, describing the personal information involved. You cannot scope that notification without attribution. King V, effective for financial years beginning on or after 1 January 2026, requires demonstrable accountability for actions and outcomes. An action logged only against a shared service account is demonstrable to nobody.
What did the Salesloft Drift incident actually prove?
In August 2025, attackers stole OAuth and refresh tokens belonging to an AI chat agent and used them to reach connected customer relationship systems. Fourteen companies publicly confirmed impact. The model was never touched. It proved that the fastest route into an agent estate is credential theft and weak third-party integration visibility, not manipulation of the model itself.
WHERE TO GO FROM HERE
- Start at the hub, The OWASP Agentic Top 10 for South Africa, which carries the full regulatory mapping table across all ten risks.
- Book an AI Exposure Review. You get a full agent inventory, an identity and permissions picture, and one live adversarial test against one production agent, so you can see this for yourself.
TAKE ACTION
TEST IT BEFORE SOMEBODY ELSE DOES
Thirty minutes on your agent estate and what this risk looks like in your environment.