Confused Deputy (Agentic AI)
A vulnerability where an agent with legitimate but broad authority is manipulated into using that authority on behalf of an attacker who could not exercise it directly — the agentic-AI instance of a classical access-control problem.
The confused deputy problem predates agentic AI by decades — it names any situation where a program with more privilege than its caller is tricked into misusing that privilege on the caller's behalf. Agentic AI reintroduces it at scale: an agent frequently holds a service-level credential broader than any individual user's own access, and the agent's job is precisely to act on user requests using that broader credential.
A canonical example: a customer-support agent uses a single service account with access to all customer records to answer questions for any user. If the agent doesn't independently verify that the requesting user is authorised to see the specific record being requested, any user can ask about any other customer's data and the agent — acting as confused deputy — retrieves it using its own broad, unscoped credential.
This differs from excessive agency in emphasis: excessive agency is about the agent holding more capability than its task needs; confused deputy is specifically about the mismatch between the agent's own authorisation and the requesting party's authorisation not being checked at the point of action. An agent can have exactly the capability its task requires and still be a confused deputy if it never verifies per-request authorisation against its broader credential.
The control is object-level and per-request authorisation checks, enforced independently of the agent's own reasoning: verify that the specific user making this specific request is entitled to the specific object or action, every time, rather than trusting that the agent's possession of a broad credential implies the request itself is authorised.
Confused deputy risk is easy to miss in review because the agent's overall access looks reasonable in aggregate — a support agent plausibly needs access to customer records. The defect only becomes visible when the review asks the narrower question: does the agent check that this specific requester may see this specific record, or does it trust the service account's blanket access?