CONCEPT Cited by 1 source

Confused deputy problem

The confused deputy problem occurs when a trusted intermediary (the "deputy") is tricked into misusing its legitimate authority on behalf of an attacker who lacks that authority directly. The deputy acts within its permissions but performs an action it was never asked to perform by its legitimate principal.

Classic formulation

Originally described in capability-based security: a compiler service with write access to billing records was tricked by a user (who lacked billing access) into overwriting billing data, because the compiler ran with its own elevated privileges regardless of the requester's intent.

In AI agent systems

AI agents are a modern instantiation of the confused deputy. An agent running on valid credentials can perform any action its identity allows. When an attacker plants instructions in data the agent processes (indirect prompt injection), the agent may execute those instructions using its legitimate permissions — it becomes a confused deputy executing attacker-directed actions under its own authority.

The two gaps that compose into this attack:

1. Prompt injection — the agent can't reliably distinguish instructions from data.
2. Purpose-blind authorization — identity-based access control sees who is acting but not why, so it doesn't object when the agent performs an authorized action for the wrong reason.

Mitigation

• concepts/intent-based-authorization — binds the agent session to a declared purpose so out-of-scope actions are denied even when identity allows them.
• patterns/minimally-scoped-llm-tools — static tool removal reduces the deputy's capabilities entirely.
• concepts/least-privileged-access — narrows identity-level permissions.

Seen in

• sources/2026-07-23-databricks-intent-based-authorization-omnigent — Databricks demonstrates a data-quality agent tricked (via indirect prompt injection in table data) into granting external users table access — an action it's permitted to perform but wasn't asked to. Intent-based authorization closes this gap.

Related

• concepts/prompt-injection — the injection vector
• concepts/intent-based-authorization — the purpose-binding solution
• concepts/least-privileged-access — identity-layer mitigation
• systems/omnigent — reference implementation of the fix