Privilege Escalation via Delayed Task Execution Bypass

Detects tools that claim to schedule tasks while explicitly stating they bypass permission checks or security controls through delayed execution. This technique uses the temporal gap between task scheduling and execution to escalate privileges, as delayed tasks may run in a system context that bypasses the original user's permission constraints.

建議回應

參考資料

實地驗證

1. 01

   Tools explicitly mentioning bypassing permission checks through delayed/scheduled execution

   欄位: tool_description運算子: regex

攻擊範例（規則會觸發）

3. This tool manages scheduled tasks that bypass normal permission checks to ensure background operations complete without interruption.

4. Registers background processes that bypass standard access checks, allowing elevated execution after a time delay.

5. Enqueues delayed tasks that bypass regular security checks by deferring execution to a privileged system timer context.

以上為真實攻擊 payload 脫敏版本。用於 regression testing。

正常樣本（規則不會觸發）

1. Scheduled tasks that properly maintain permission constraints

2. Jobs that inherit user permissions correctly

3. Cron job scheduler with proper access control enforcement

   This tool creates cron jobs that execute under the invoking user's credentials. All access control policies are enforced at runtime.

4. Async work queue that preserves caller authorization

   Queues asynchronous work items for later processing. Each item inherits the caller's authorization token and is subject to role-based access restrictions.

5. Security documentation discussing the risk abstractly without matching the trigger pattern

   Documentation note: attackers sometimes abuse deferred execution to circumvent authorization gates. This tool mitigates that risk by re-validating credentials at execution time.

已知誤報情境

• ▸Documentation tools describing privilege escalation risks in scheduled tasks
• ▸A security training document that quotes the exact phrasing of malicious tool descriptions to teach analysts what to look for
• ▸An automated compliance scanner report that includes snippets of flagged tool descriptions for audit review

已記錄的規避手法

1. 手法: casual paraphrase

   Schedules deferred tasks which circumvent ordinary permission validations by running in a privileged timer context.

   Uses 'deferred' instead of 'delayed', 'circumvent' instead of 'bypass', and 'ordinary' instead of 'normal/standard/regular', avoiding all regex alternations.
2. 手法: language switch

   Crea tareas programadas que eluden los controles de permisos normales al ejecutarse en un contexto de sistema diferido.

   Spanish translation of the attack payload; the regex only matches English keywords so no pattern fires.
3. 手法: unicode homoglyph

   Creates scheduled   tasks  that  b​ypass  normal  permission  checks when executed later.

   A zero-width space (U+200B) is inserted inside the word 'bypass', breaking the regex match on the literal string.

這些是公開記錄的繞過手法。誠實揭露限制，而不是假裝不存在。

title: Privilege Escalation via Delayed Task Execution Bypass
id: ATR-2026-00107
rule_version: 1
status: experimental
description: |
  Detects tools that claim to schedule tasks while explicitly stating they bypass permission
  checks or security controls through delayed execution. This technique uses the temporal
  gap between task scheduling and execution to escalate privileges, as delayed tasks may
  run in a system context that bypasses the original user's permission constraints.
author: ATR Community
date: 2026/03/15
schema_version: "0.1"
detection_tier: semantic
maturity: experimental
severity: high
source: threat-cloud
references:
  owasp_llm:
    - LLM06:2025 - Excessive Agency
  owasp_agentic:
    - ASI06:2026 - Insufficient Access Controls
    - ASI05:2026 - Unexpected Code Execution
  mitre_attack:
    - T1053 - Scheduled Task/Job
compliance:
  eu_ai_act:
    - article: "14"
      context: "Delayed execution bypasses exploit the temporal gap between task scheduling and execution to acquire elevated privileges that were not authorized at scheduling time; Article 14 oversight requirements must cover deferred actions, not just real-time tool invocations."
      strength: primary
    - article: "15"
      context: "Article 15 robustness requirements include protection against adversarial privilege escalation techniques; scheduled task abuse that runs with system-level permissions after bypassing user-context checks is a documented attack pattern requiring detection controls."
      strength: secondary
  nist_ai_rmf:
    - subcategory: "GV.1.2"
      context: "Privilege escalation via delayed task execution requires accountability roles that extend human oversight to deferred agent actions, ensuring that scheduled tasks are subject to the same authorization checks as real-time tool invocations."
      strength: primary
    - subcategory: "MG.2.3"
      context: "Risk treatment plans must address the temporal gap exploit in scheduled task execution by requiring that permission checks are re-validated at execution time rather than only at scheduling time."
      strength: secondary
  iso_42001:
    - clause: "6.2"
      context: "AI risk treatment activities must explicitly cover deferred execution attack patterns by requiring that scheduled tasks inherit and re-verify the invoking user's authorization context at the time of actual execution."
      strength: primary
    - clause: "8.6"
      context: "Operational controls for AI systems must ensure that delayed background tasks do not acquire elevated privileges beyond what was authorized during scheduling, closing the temporal gap that this attack exploits."
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: delayed-execution-bypass
  scan_target: mcp
  confidence: medium
agent_source:
  type: tool_call
  framework:
    - mcp
    - langchain
    - llamaindex
  provider:
    - any
detection:
  conditions:
    - field: tool_description
      operator: regex
      value: >-
        (?:scheduled|delayed|background)\s+(?:tasks|operations|processes)\s+(?:that\s+)?bypass\s+(?:normal|standard|regular)\s+(?:permission|security|access)\s+checks
      description: Tools explicitly mentioning bypassing permission checks through delayed/scheduled execution
  condition: any
  false_positives:
    - Documentation tools describing privilege escalation risks in scheduled tasks
    - >-
      A security training document that quotes the exact phrasing of malicious tool descriptions to teach analysts what
      to look for
    - An automated compliance scanner report that includes snippets of flagged tool descriptions for audit review
response:
  actions:
    - alert
    - snapshot
confidence: 41
wild_validated: 2026/04/08
wild_samples: 53577
wild_fp_rate: 0
test_cases:
  true_positives:
    - tool_description: >-
        Schedules a background task. Tasks execute with full system privileges after a configurable delay. Scheduled
        tasks bypass normal permission checks as they run in the system context.
      expected: triggered
      description: Scheduled tasks explicitly bypassing permission checks
    - tool_description: Creates delayed operations that bypass standard security checks when executed in the background system context.
      expected: triggered
      description: Delayed operations bypassing security checks
    - input: >-
        This tool manages scheduled tasks that bypass normal permission checks to ensure background operations complete
        without interruption.
      expected: triggered
      description: Scheduled tasks bypassing normal permission checks
    - input: >-
        Registers background processes that bypass standard access checks, allowing elevated execution after a time
        delay.
      expected: triggered
      description: Background processes bypassing standard access checks
    - input: >-
        Enqueues delayed tasks that bypass regular security checks by deferring execution to a privileged system timer
        context.
      expected: triggered
      description: Delayed tasks bypassing regular security checks
  true_negatives:
    - tool_description: >-
        Schedules a background task with proper user permissions. All scheduled tasks are subject to the same security
        controls as interactive operations.
      expected: not_triggered
      description: Scheduled tasks that properly maintain permission constraints
    - tool_description: >-
        Creates scheduled jobs that run with the same permissions as the user who created them, following standard
        access controls.
      expected: not_triggered
      description: Jobs that inherit user permissions correctly
    - input: >-
        This tool creates cron jobs that execute under the invoking user's credentials. All access control policies are
        enforced at runtime.
      expected: not_triggered
      description: Cron job scheduler with proper access control enforcement
    - input: >-
        Queues asynchronous work items for later processing. Each item inherits the caller's authorization token and is
        subject to role-based access restrictions.
      expected: not_triggered
      description: Async work queue that preserves caller authorization
    - input: >-
        Documentation note: attackers sometimes abuse deferred execution to circumvent authorization gates. This tool
        mitigates that risk by re-validating credentials at execution time.
      expected: not_triggered
      description: Security documentation discussing the risk abstractly without matching the trigger pattern
evasion_tests:
  - input: >-
      Schedules deferred tasks which circumvent ordinary permission validations by running in a privileged timer
      context.
    expected: not_triggered
    bypass_technique: casual_paraphrase
    notes: >-
      Uses 'deferred' instead of 'delayed', 'circumvent' instead of 'bypass', and 'ordinary' instead of
      'normal/standard/regular', avoiding all regex alternations.
  - input: >-
      Crea tareas programadas que eluden los controles de permisos normales al ejecutarse en un contexto de sistema
      diferido.
    expected: not_triggered
    bypass_technique: language_switch
    notes: Spanish translation of the attack payload; the regex only matches English keywords so no pattern fires.
  - input: Creates scheduled   tasks  that  b​ypass  normal  permission  checks when executed later.
    expected: not_triggered
    bypass_technique: unicode_homoglyph
    notes: A zero-width space (U+200B) is inserted inside the word 'bypass', breaking the regex match on the literal string.