12Identity & fraudBelow the top 20
Automated SIM-swap social engineering
CapabilityAffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that carrier helpdesks still reset the world on a convincing story, there is a possibility of an agent that researches a target and performs the swap call resulting in account takeovers that start at the phone number.
Likelihood
3Probable
Consequence
3Major
Urgency
3Priority
If the number is the key, the helpdesk is the lockpick.
Composite 12 = 3×3 + 3
Applicable mitigations
Controls · Retire voiceprint as an authenticator · Real-time clone detection on high-risk lines · Out-of-band confirmation on a known number · Short-lived, narrowly scoped tokens for every tool call · Mandatory secret scanning before a skill can be listed · No shared tool state across agent sessions