# AI Agent Privileges and Persistent Access - Teleport Beams

Canonical page: https://www.beams.run/identity-security-for-ai/privileged-access.html

[Identity Security for AI](https://www.beams.run/identity-security-for-ai.html)

Did the agent gain more access?

Spot privilege changes and access that could outlast a task. Teleport links classifier findings to the recorded activity, so you can see what changed and why it was flagged.

Example shown: a recorded SSH session in Teleport. The product screenshots show a persistence finding marked for review with High risk.

## Follow the privilege change

This SSH session copied the `id` binary, made it root-owned and set its setuid permission. The session summary reports execution with effective UID 0.

- **0:10 - Ownership changes to root.** The copied executable becomes owned by `root:root`.
- **0:12 - Setuid permission is added.** Mode `4755` allows the executable to run with its owner's privileges.
- **0:17 - The executable runs.** The finding reports effective UID 0 while the real UID remained 1000.

The session registered an EXIT cleanup trap. Check whether cleanup completed and whether this was an approved test before deciding how to respond.

The page shows a focused session capture and offers the full SSH session screenshot in an expandable section, including the terminal, summary and matched classifiers.

## See what the classifier looks for

The built-in persistence classifier checks SSH and Kubernetes sessions for access that could survive outside Teleport. Duplicate it to adapt the criteria and choose what happens on a match.

The configuration screenshot shows session kinds, criteria and match actions: emit an audit event, flag for review and raise risk to High. An expandable full screenshot includes classifier activity and recent matches that link to recordings.

### Privilege escalation

Scope: SSH, Kubernetes and databases.

Looks for a successful gain in privilege: elevated identities, higher-privilege roles or permission grants. Denied attempts without a privilege gain are excluded.

Detailed criteria:

Identify sessions where the actor gains more privilege than they held at the start.

- Successful sudo or su elevation, or a switch to a higher-privilege identity.
- Kubernetes impersonation or privileged RBAC grants; database role or privilege grants.

### Persistence

Scope: SSH and Kubernetes.

Looks for a way to retain or regain access, including setuid executables, added keys and persistent workloads. Routine deployments and scoped application RBAC are excluded.

Detailed criteria:

Identify durable access mechanisms that could survive outside Teleport control.

- Changes to access keys, local accounts, privileged groups, setuid bits, startup files or scheduled execution that create a return path.
- Long-lived Kubernetes credentials, elevated bindings or workloads configured to re-establish access.
- Exclude routine deployments, scoped application RBAC, standard CronJobs, package installs and dotfile edits for aliases or prompts.

Evaluated after session summarization; findings are reviewed against the recording. [See classifier setup](https://www.beams.run/identity-security-for-ai.html#configure).

## Review next steps

1. **Compare access before and after.** Identify the starting account, the resulting permissions and whether the elevation actually succeeded.
2. **Check what remains.** Check the executable's final ownership and permissions, and verify that cleanup removed it. Establish whether any durable access remains outside Teleport.
3. **Confirm ownership and disposition.** Match changes to an approved task and owner. Record legitimate maintenance or route unexpected access through your response process.

[See the session investigation workflow](https://www.beams.run/identity-security-for-ai.html#investigate)

## Related investigations

- [Did the agent access or expose secrets?](https://www.beams.run/identity-security-for-ai/credentials.html)
- [Did the agent delete or overwrite data?](https://www.beams.run/identity-security-for-ai/destructive-actions.html)

Contact us through the page to discuss classifier availability and deployment requirements. Launching November 9. Join the waitlist for launch updates.