Escalating your agent to SYSTEM via access token theft