AI Systems Atlas

S-05Confused Deputy

/security/confused-deputy

A low-privilege requester tricks a high-privilege agent into doing something the requester could never do directly.

Step-by-step walkthrough2 variants · 6 steps

Attack

  1. The requester has no admin rights…
  2. …but the agent does. The API sees a trusted caller and complies.
  3. The agent’s authority was borrowed by someone who never had it.

Defended

  1. Same request arrives.
  2. The agent holds no standing admin power — it borrows the requester’s identity per call.
  3. The API evaluates the real principal and denies. Authority no longer amplifies through the agent.
Key insight

The fix is decades old: don’t act on ambient authority. Every action should be evaluated against the requester’s permissions, not the agent’s.

Failure mode

One service account with admin scope shared across every user of the agent — the classic deputy, now with natural-language persuasion attached.

Further reading
RelatedDirect injectionPrivilege escalation

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →