Developer Demos How AI Agents Can Take Over Accounts Despite Passing All Permission Checks

A developer has published a reproducible proof-of-concept showing that AI agents can execute account takeovers even when every individual tool call passes standard permission checks. The attack exploits the order of operations — reading a ticket, changing an email, then triggering a password reset — each step permitted under role-based access control, but the sequence collectively enabling a takeover. The researcher argues that per-call RBAC is insufficient when an agent operates with broad roles and the sequence itself is the vulnerability. As a countermeasure, the demo also includes a composition-aware gate that blocks credential recovery actions following identity mutations within the same session. The proof-of-concept runs entirely on Python's standard library with no external dependencies and is publicly available on GitHub.