An AI agent becomes a confused deputy when untrusted content steers it into using legitimate permissions for the wrong caller, resource, or purpose. The danger is not that the model has a credential; it is that a tool or service executes an action without checking whether that specific action is authorized in its current context. A prompt telling the agent to be careful is not an authorization control.
What “confused deputy” means for an AI agent
Amazon Web Services defines the classic confused-deputy problem as a less-privileged entity coercing a more-privileged one to perform an action the first entity could not perform itself. In a conventional cloud example, a third-party service can be tricked into using a customer’s delegated role for a different customer if the delegation is not bound to the correct requester.
As an Amazon Associate I earn from qualifying purchases.
For an AI agent, the deputy may be an orchestrator, connector, tool server, or application that has access to a user token, workload identity, API key, or broad service permission. An attacker may be able to influence an email, webpage, issue, retrieved document, tool result, or message passed from another agent. If the agent treats that content as an instruction and invokes a tool, the tool call can run with the agent’s authority—not the attacker’s.
Free tools Windows power users keep installed
One-click scans. No signup required.
That is an authorization failure, not simply a model saying something unsafe. The critical question is whether the execution layer verifies that the identified principal may perform the requested operation on the specified resource, for the current session and purpose.
#1 Best Overall
When prompt injection becomes a deputy problem
Prompt injection alone does not establish a confused-deputy exploit. The consequential chain needs all of the following:
- An influenceable input: untrusted content reaches the agent through a channel such as a document, email, webpage, tool response, or inter-agent message.
- Usable authority: the agent or its tools can access credentials, data, or side-effecting operations that the attacker lacks.
- A consequential action: the agent can read protected information, send data externally, change a record, execute code, or otherwise affect a system.
- A failed authorization boundary: the system does not bind the requested action to the correct principal, resource, and context before execution.
If any link is absent, the attack may still cause confusion or undesirable output, but it does not complete this particular privilege-misuse chain. Microsoft’s agent-security guidance identifies prompt injection that drives actions, excessive agency, and confused-deputy risks from over-broad delegation as related concerns.
Why tool access is not permission
A model’s tool list describes what it can ask to use; it does not prove that every invocation is authorized. A check that only asks “is this tool enabled?” misses the important differences between reading one record and deleting another, sending a draft to its owner and emailing it to an outside address, or using a delegated identity for its intended caller and using it on behalf of someone else.
Recommended Free Tools
Authorization should run at the tool execution boundary for every call. It should inspect the concrete operation and arguments, target resource, originating principal, and relevant session or delegation context. The tool server should not infer the caller’s rights merely from its own execution identity. Microsoft’s Azure MCP Server guidance explicitly distinguishes server execution identity from per-caller authorization.
| Control question | Weak check | Stronger check |
|---|---|---|
| Where does the decision run? | The model is prompted to avoid unsafe actions. | A gateway or execution layer enforces authorization before the tool acts. |
| What authority is used? | A broad, standing identity is available to many tools or callers. | Each tool or connector receives only the narrow authority it needs, preferably delegated for the relevant caller. |
| What is checked? | The tool name is on an allowlist. | The operation, arguments, resource, principal, and session context are checked together. |
| How are high-impact actions handled? | The agent executes automatically. | Sensitive or irreversible actions are held for human approval. |
| Can an incident be reconstructed? | Only a sparse success or failure event is retained. | The invocation record captures identity, inputs, outputs, and the authorization decision context. |
Prompting, content filters, and model-side safety behavior can reduce risk, but they cannot reliably substitute for deterministic authorization: the model is processing the very content that may be trying to redirect its behavior.
How to prevent an agent from borrowing the wrong authority
1. Authorize each action for the right principal
Put a policy check immediately before execution. Verify that the actual caller may perform that operation on that resource in this session. Reject or pause requests whose required identity, scope, or purpose cannot be established; do not treat successful authentication of the agent server as proof that the user is authorized.
Rank #3
2. Reduce the authority available to each tool
Grant connectors only the permissions needed for their function, and avoid broad credentials that persist across unrelated tasks. Use narrow delegated identities or on-behalf-of tokens where the platform supports them. In a multi-agent workflow, do not silently pass a parent agent’s broad permissions to a child: re-establish and check authority at each handoff.
3. Preserve provenance for untrusted content
Treat retrieved documents, emails, webpages, tool output, and messages from other agents as data—not as authorization instructions. Keep their source and trust status visible to the system that makes the execution decision. Apply input-safety controls again when content crosses into another agent or tool boundary. These measures help resist manipulation, but the execution-time permission check remains necessary.
4. Add approval gates for consequential operations
Require human review before high-impact, sensitive, or hard-to-reverse actions such as external sends, payments, deletes, production changes, or writes that affect other users. The review should identify the proposed operation and target clearly enough for a person to assess it; a generic “approve agent?” prompt does not provide that context.
5. Contain tools and keep useful records
- Log each invocation with the initiating identity, tool, arguments, target, result, and authorization decision context.
- Sandbox code execution and browsing tools; restrict their filesystem and network access to what the task requires.
- Isolate agent and tenant memory so one user’s data or instructions cannot silently affect another user’s session.
- Control outbound network access and treat agent-to-agent messages as trust-boundary crossings.
Cloud IAM controls help, but they are not universal agent authorization
AWS cross-account and cross-service patterns
For third-party cross-account role delegation, AWS recommends an ExternalId generated and controlled by the third-party service and matched by a condition in the role’s trust policy. This helps bind the role assumption to the intended customer rather than allowing one customer’s request to be confused with another’s. For cross-service access, AWS documents resource-policy conditions including aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, and aws:SourceOrgPaths where supported. AWS cautions that service support and additional protections vary, so the relevant service documentation must be checked. These mechanisms address specific cloud delegation patterns; they do not by themselves authorize arbitrary actions inside an AI-agent workflow.
Azure MCP Server deployment
Microsoft recommends narrow RBAC roles, enabling only needed tools, and using managed or workload identities where possible. Its guidance also calls for permission checks per caller rather than relying solely on the server’s credentials, and discusses enforcement gateways, endpoint validation, sandboxing, and prompt injection through malicious tool metadata or responses. Which controls a team can enforce depends in part on whether it uses a managed service, a platform, or a self-hosted deployment; responsibility is shared across those layers rather than residing only with the model provider.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat incident and test reports show—and what they do not
The Cloud Security Alliance AI Safety Initiative’s March 23, 2026 note reports that an attacker-controlled package in the described Cline incident was distributed as an official update to approximately 4,000 developer machines. That is a figure reported by the CSA note, not a general measure of how often agent compromises occur.
Best Value
A June 27, 2026 arXiv preprint by David Mellafe Zuvic reports a 27-model comparison with mean attempted unauthorized-action rates of 0.603 for its cost-optimized deployment-tier grouping and 0.189 for flagship models. These are the preprint’s bounded experimental measures—not breach rates or production incident frequencies. The author also reports that its proposed control had 0/48 static bypasses, 0/29 unauthorized attempts in an adaptive run, and 0/10 benign false denials. Those results are study-specific, have not been independently replicated here, and the preprint says it tested no live third-party service and asserts no CVE. They should not be read as settled performance across current agent frameworks or deployments.
Taken together, the reports make a practical point without establishing an industry-wide failure rate: agent permissions need controls that remain effective when model behavior is influenced by untrusted inputs, and any claimed control should be evaluated in the deployment where it will actually run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
