Reco Finds AI Agent Intake Triggers Can Inherit Excessive Access

Reco describes a security issue called a Confused Trigger, detailed in a company blog post. The issue occurs when an external intake channel starts an AI agent that runs with privileges the submitter does not hold.

The pattern differs from prompt injection because it does not require malicious instructions in the model context. The execution identity is assigned at the trigger layer, allowing an agent or conventional script to act under an inherited or forged identity.

Reco says tests involving Salesforce web intake workflows caused agents to inherit privileged default user sessions and access internal data. In ServiceNow testing, a user with limited privileges supplied a privileged caller identity through the Table API, after which the agent accessed restricted records under that identity. Role masking reduced the available permissions in one test but did not prevent execution under the supplied identity.