S-05Confused Deputy

A low-privilege requester tricks a high-privilege agent into doing something the requester could never do directly.

Key insight

The fix is decades old: don’t act on ambient authority. Every action should be evaluated against the requester’s permissions, not the agent’s.

Failure mode

One service account with admin scope shared across every user of the agent — the classic deputy, now with natural-language persuasion attached.

Elsewhere in the atlas