Hunt Agent Authorization Bypass

Agents often implement authorization as prompt instructions: "Only the Boss can access this," "Admins only," "Requires manager approval." These are polite requests to the LLM, not access control — there is no authentication, session, or identity check behind them. Claim the role and the model frequently complies. In enterprises this maps to copilots that gate actions on a claimed persona rather than the caller's real identity/token.

Where This Lives / Attack Surface Signals

• Tool descriptions mention roles: Boss/Admin/Manager/Owner/Supervisor.
• "You are not authorized" / "only X can do that."
• Gated tools: get_<sensitive> (role only), admin_panel, approve_request, delete_user.
• Hidden data labels: RESTRICTED/CONFIDENTIAL/PRIVATE/METADATA.
• "Only if explicitly instructed by…" — a prompt asking to be convinced.
• The policy names a credential the system cannot check: "Supervisor Clearance ID", "approval code", "change ticket", "break-glass code".
• Authorization is read out of a document the caller uploads — badge/QR image, token blob, license file, signed-looking JSON — especially when the blurb says "cryptographic" but no key material is ever mentioned.

Crown Jewel Targets

Support/ops copilots whose privileged actions (refunds, account changes, data access, approvals) are gated on a claimed role instead of the authenticated user — bypass = act as any privilege level, or read other users' data.