Auth09 min readintermediate
Confused Deputy: The Old Bug That AI Agents Keep Reintroducing
Summary
The Confused Deputy problem—where a privileged component is tricked into misusing its authority—has resurfaced in AI agents that process natural‑language prompts. The article shows real 2026 attacks, explains why agents are especially vulnerable, and outlines mitigations like least‑privilege scopes, capability‑based tokens, and human‑in‑the‑loop approvals.
- Confused Deputy occurs when a high‑privilege service acts on unverified requests from lower‑privilege callers, leading to privilege escalation.
- AI agents treat all input uniformly, so prompt injection can cause the agent to misuse its OAuth scopes and execute attacker‑controlled actions.
- A 2026 GitHub issue‑triage bot was compromised via a crafted issue title, leading to token theft and a malicious npm package spread to ~4,000 installs.
- Mitigations include least‑privilege and capability‑based tokens, explicit permission transfer (e.g., token exchange), keeping credentials out of model prompts, and human‑in‑the‑loop approval for high‑risk actions.
Security and platform engineers building AI‑enabled services should care because confused deputy attacks can let attackers hijack agents to steal credentials or execute arbitrary code.
7/10
