What it is
Identity spoofing is the "S" in STRIDE applied to agent ecosystems. The classic form is impersonating an end user — submitting a request that looks like it came from your CFO so the agent approves a wire transfer. The agent-era forms are richer: impersonating another agent in an A2A handoff so a downstream agent grants trust it should not; spoofing the identity of an MCP server so the calling agent receives malicious tool definitions; presenting a forged service-account token; using session-token replay to ride on a legitimate user's authorization. Each variant exploits the fact that identity in a multi-agent system has many edges, and any one of them can be the weak link.
Why it matters
Agent ecosystems are increasingly a web of trust between agents, tools, MCP servers, OAuth scopes, and human users. Every edge is an authentication boundary. Many teams secure the user-to-agent edge well (because that is where the front door is) and forget the agent-to-tool, agent-to-agent, and agent-to-data edges entirely. Salesforce customers should ensure every agent has a unique identity (not a shared service account), every tool call is authenticated, and every cross-agent handoff carries provenance — not just a free-text "I am the orchestrator."
Key components
- User impersonation — adversary requests look like a trusted user
- Agent-to-agent spoofing — a malicious agent claims to be a trusted peer
- MCP / tool server spoofing — attacker controls a server the agent calls
- Token replay — captured credentials reused outside their intended context
- Mitigation — per-agent identity, signed handoffs, short-lived tokens, request provenance
How it connects
In Agentforce, an agent handling a service case might receive instructions from what appears to be your internal orchestrator agent — but without verified identity on that handoff, a spoofed caller can redirect the agent to exfiltrate data or approve actions outside its intended scope. Agent-to-agent (A2A) and MCP connections both introduce these handoff points, making authenticated provenance a deployment requirement, not an afterthought.
Good to know
Shared service accounts are a common shortcut that quietly become a major liability — if one agent's credentials are compromised or abused, there is no way to tell which action came from which agent, and rolling back access means cutting off everything at once. Give each Agentforce agent its own named identity and audit trail from day one.
Related terms
Agent Governance
The policies, controls, and monitoring systems that ensure AI agents operate safely, compliantly, and within business-approved boundaries.
A2A (Agent-to-Agent Protocol)
Google's open protocol that allows AI agents from different vendors to communicate and collaborate with each other.
MCP (Model Context Protocol)
Anthropic's open standard for connecting AI models to external data sources and tools. Think of it as a universal adapter for AI.
STRIDE
A six-category threat-modeling framework — Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege — adapted from classic software security to AI agents.
Threat Modeling (AI Agents)
A structured way to identify what could go wrong with an AI agent before it does — mapping attackers, attack surfaces, and impacts so you can build defenses in.
Privilege Compromise
When an AI agent has been granted broader access than its task actually requires, every other vulnerability becomes more damaging — and the gap is usually a misconfiguration, not an attack.
