The confused deputy problem was described in 1988. A program holding more privilege than the requester is induced into using that privilege on behalf of someone who lacks it. Nearly forty years later, agents restage the pattern with one difference: the deputy now interprets natural language.
Why agents make ideal deputies
Three characteristics combine badly:
- Amplified privilege. The agent's service account usually aggregates permissions from several users.
- Natural language instructions. There is no syntax separating a legitimate request from an induced one.
- No origin verification. The agent does not distinguish who asked — the user, a document it read, or a tool description.
The pattern already appears in production CVEs: CVE-2026-13341 describes indirect injection against the Kong Konnect MCP server leading to unintended API requests executed on the caller's behalf. This is not a lab finding.
The agent was not deceived about what to do. It was deceived about who was asking.
The classic fix, adapted
The solution to confused deputy was never filtering requests. It was binding authority to the requester — capabilities instead of ambient authority. Translated for agents:
- Delegation ceiling. Effective authorisation is the intersection of agent and delegator. If the request came from a document, there is no delegator, so the ceiling is minimal scope.
- Tokens with audience and per-task scope, not ambient credentials any code path can reach.
- Provenance in context. Tag each context block with its origin and use that in the policy decision.
Why insist on the old name
Because recognising the pattern unlocks forty years of tested solutions. Treating it as “a new AI problem” discards that body of work and leads to improvised defences — typically text filters, which is exactly the response category the 1988 literature already dismissed.
