AID-E-001: Compromised Credential, Session, Principal & Grant Eviction
Scope boundary
Owns authoritative incident-time eviction of four authentication and authorization object populations: root or long-lived credential objects, already-issued tokens and authentication sessions, AI-agent or workload principals and issuance paths, and delegated grants or connected-app authorizations. Evidence for one population does not prove eviction of another.
AID-E-002: AID-E-001 revokes authentication and authorization objects; AID-E-002 terminates active processes, agent runs, execution leases, supervisor jobs, pods, and containers. Credential or session revocation does not prove that compromised code stopped executing, and process termination does not revoke the identities or artifacts that could start new execution.
AID-E-005: AID-E-001 evicts identity-plane credentials, sessions, principals, and grants; AID-E-005 removes durable application and agent state. Application session records, conversational memory, webhook or tool registrations, queues, and schedules require separate teardown even after authentication objects are revoked.
AID-R-003.001: AID-E-001 invalidates compromised or prior authentication and authorization state; AID-R-003.001 creates a new trusted interactive session after eviction. Successful reauthentication does not prove that the old credential, token, grant, or session population was revoked, and eviction does not itself establish a recovered session.
AID-I-003: AID-E-001 authoritatively and durably revokes compromised credentials, sessions, principals, issuance paths, and delegated grants; AID-I-003 applies reversible quarantine, safe-mode downgrade, throttling, or action containment while investigation or recovery proceeds. Containment does not prove identity-plane eviction, and revocation does not replace immediate bounded control of the affected workload, session, or action.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0012 Valid Accounts
- AML.T0055 Unsecured Credentials
- AML.T0090 OS Credential Dumping
- AML.T0091 Use Alternate Authentication Material
- AML.T0091.000 Use Alternate Authentication Material: Application Access Token
- AML.T0091.001 Use Alternate Authentication Material: Web Session Cookie
- AML.T0121 AI Agent Environment Reconstruction
- AML.T0125 Create Account
MAESTRO
- Agent Identity Attack (L7)
- Lateral Movement (Cross-Layer)
- Privilege Escalation (Cross-Layer)
OWASP LLM Top 10 2026
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
OWASP ML Top 10 2023
- ML05:2023 Model Theft
OWASP Top 10 for Agentic Applications 2026
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.031 Model Extraction
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-2.1 Excessive Agency
- AITech-4.1 Agent Injection
- AITech-7.4 Token Manipulation
- AITech-8.2 Data Exfiltration / Exposure
- AITech-14.1 Unauthorized Access
- AITech-14.2 Abuse of Delegated Authority
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-4.1.1 Rogue Agent Introduction
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-7.4.1 Token Theft
- AISubtech-14.1.1 Credential Theft
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-14.2.1 Permission Escalation via Delegation
Google Secure AI Framework 2.0 - Risks
- MXF: Model Exfiltration
- SDD: Sensitive Data Disclosure
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Platform 12.4: Unauthorized privileged access
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.9: Identity Spoofing & Impersonation
- Agents - Core 13.13: Rogue Agents in Multi-Agent Systems
- Agents - Tools MCP Server 13.19: Credential and Token Exposure
- Agents - Tools MCP Client 13.31: Excessive Permission Granting