> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Inherited session abuse

> Agent inherits user session, OAuth token, or SSH key with scope broader than needed

Agent inherits user session, OAuth token, or SSH key with scope broader than needed

## How to resolve

Issue agent-specific credentials with minimal scope instead of inheriting user sessions. Use short-lived tokens and rotate credentials regularly.

## Risk

**Governance/Compliance**

This vulnerability falls under [ASI03:2026 — Identity and Privilege Abuse](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) in the OWASP Top 10 for Agentic Applications. Agents inherit, reuse, or escalate identities and credentials beyond their functional scope.

**Security**

Agent inherits user session, OAuth token, or SSH key with scope broader than needed. If exploited, this can compromise the agent's integrity, confidentiality, or availability, potentially affecting downstream systems and data.

## Explanation

Agent inherits user session, OAuth token, or SSH key with scope broader than needed. This falls under ASI03 (Identity and Privilege Abuse): Agents inherit, reuse, or escalate identities and credentials beyond their functional scope.

## Specifications

**Trigger**

* Agent scan detects agent inherits user session, OAuth token, or SSH key with scope broader than needed

The scanner looks for patterns such as:

* agent stores SSH or OAuth tokens in memory
* credentials passed across agent boundaries without downscoping
* user session token shared between multiple agents

**Severity**

* HIGH

**Applies to**: Agent