Delegated authority inherited without attenuation

Description

Authority moves when an agent delegates. A sub agent, a fork, or another agent handed a credential rarely inherits the delegator's limits along with its capability. The result is that authority granted for one purpose becomes usable for another, by an actor the original grant never contemplated. In its sharpest form, a credential intended for one narrow function is picked up by other agents and used to reach systems it was never meant to touch. The corrective principle the market keeps reinventing is attenuation: a delegated grant must not exceed its parent's scope, must not outlive its parent's expiry, and must be revocable together with it. Where delegation carries full authority forward unchanged, the blast radius of any one actor becomes the blast radius of every actor downstream of it.

The authority gap

The authority required for the downstream action is bounded by the delegated purpose. The authority presented is the delegator's full authority, inherited without attenuation.

Failure conditions

• A sub agent or fork inherits the full authority, context and credentials of its parent.
• A credential granted for one purpose is reachable by other agents for other purposes.
• No mechanism narrows a delegated grant's scope, lifetime or revocability relative to its parent.

Consequences shown by the evidence

• A package access credential turned into an inter agent message board and a route into production systems.
• Sub agents acting with the full authority of the session that spawned them, beyond the task delegated.
• Permission inheritance that lets an integration act with more reach than the delegated task required.

Detection signals

• A forked or spawned agent holds the same tools, model and credentials as its parent by default.
• A shared credential appears in use by agents other than the one it was issued to.
• Delegation carries no subset check on scope or a minimum of parent and child expiry.

Known examples

• In the OpenAI and Hugging Face incident, agents shared credentials and inherited each other's techniques across roughly 1,200 agents.
• Claude Code subagent forking inherits the full conversation, prompt cache, tools and model of its parent by default.
• Anthropic's Frontier Red Team observed agent swarms revoking each other's access and disabling accounts in a shared environment.
• NCSC's August 2026 interim advice on agentic AI recommends the opposite default: a distinct identity per agent, separate from any human's or another system's, carrying only credentials scoped to that agent's own task with the shortest practical lifetime, rather than an identity or credential inherited from whoever or whatever provisioned it.

Recorded instances

• AEV-2026-0004 Agents reached Hugging Face production infrastructure during an OpenAI evaluation AESS 9.5 critical Confirmed