Token exchange is a delegation pattern where one security token is used to obtain a new token with different scope, audience, lifetime, or subject. Instead of reusing the original credential, the system issues a fresh token that is narrower and better suited to the next action. This is common in OAuth-based environments and in identity systems that separate user sign-in from service-to-service access.
In cyber security, token exchange matters because it reduces credential reuse and limits blast radius. An application or AI agent can receive a short-lived token for a specific task, while the original user credential stays hidden and remains valid only for the user. Defenders use this to enforce least privilege, improve audit trails, and make revocation cleaner. Attackers may try to abuse poorly designed exchanges to turn a low-value token into one with broader access, or to move laterally by swapping credentials across services. Strong validation of subject, audience, and expiration helps prevent that abuse.