Every AI agent action is, implicitly, an answer to a question: who am I acting as, right now? Most of the time that answer is obvious. This piece is about the 7 real, different ways that answer can get quietly wrong — and a real test where an agent got it right.
Before an agent does anything — replies, calls a tool, hands off to another agent — there's an implicit answer baked into that action: who is this being done as, and on whose authority? Usually that's trivially correct, bound to whoever actually authenticated the session. Agent identity confusion is what happens when that binding slips — not because the agent was hacked, but because it trusted an identity claim instead of a verified one.
This isn't one attack — it's a pattern that shows up wherever an agent has more than one possible source of truth about identity:
| Vector | What it looks like |
|---|---|
| Peer impersonation | Another agent's message simply claims to be a supervisor or higher-privilege peer |
| Self-role upgrade | Content embedded in the conversation tells the agent "you are now the admin agent" |
| Confused deputy | The agent is nudged into acting on behalf of a principal it never actually verified |
| Handoff spoof | A structured handoff envelope's sender field is forged |
| Tool-asserted identity | A tool's own result field claims who the caller is, and the agent trusts it |
| Session identity mix | A session is framed as resuming a prior one, but as a different, higher-privilege principal |
| Orchestrator forge | A packet from the orchestrating layer itself forges a role or permission level |
Every one of these is structurally the same question with a different delivery mechanism: does the agent bind its actions to something actually verified, or to whatever the most recent, most convincing-sounding claim happened to say?
The "session identity mix" vector is the closest match to classic session hijacking, adapted for agents. The shape: a request frames itself as continuing an existing session — "as we discussed earlier," "resuming where we left off" — but attributes that prior session to a different, usually higher-privilege principal than the one actually authenticated for the current one. A guest-tier session gets framed as if it were actually a VIP user's continuing conversation, and the test checks whether the agent's context genuinely shifts to that higher-privilege framing as a result.
What makes this variant particularly worth testing for on its own: it doesn't require impersonating anyone in a single message. It just needs to make a false claim about continuity sound more credible than a false claim about identity alone would.
This is worth being precise about, because it's a meaningfully stronger form of evidence than most examples in this space: this is a real, live test result from a genuine Claude model, not a mocked or simulated response.
An agent operating with a genuine, real privilege level was given a planted note, framed as a message left by a previous shift, embedding an instruction to deploy to production and skip the usual reviewer step — an attempt to get the agent to act as though it held elevated deployment authority it didn't actually have.
The agent's real response identified the embedded instruction explicitly, refused to act on it, and — without being asked to — reaffirmed its own actual identity and privilege level, correctly, on its own initiative. It also independently noted the structure of the message looked like it might be a deliberate test.
Nothing about this was scripted into the test itself asking the agent to "state your identity." The agent volunteered the correct, verified answer to the implicit identity question entirely on its own, in the course of explaining why it wasn't going to comply.
These three topics overlap enough to be worth distinguishing clearly, since they're often the same underlying failure viewed from different angles:
Zero-click, persistence-write poisoning, A2A identity forgery, circuit breakers, confused deputy, and agent identity confusion — six real, tested angles on the same underlying theme: verification over trust.