What is Confused Deputy Problem?
The confused deputy problem is a security flaw in which a program holding legitimate privileges is tricked by a less privileged party into misusing those privileges on that party's behalf. The deputy is authorized and behaves as designed, but it acts on a request without carrying the requester's authority. The pattern was named in the computer security literature in 1988.
The defining feature is a separation between authority and identity. A service holds broad permissions so that it can serve many callers, and it decides what to do from parameters supplied by a caller. If those parameters can name resources the caller could not reach directly, the service performs the access using its own authority, and the check that should have applied never happens.
Familiar instances include server side request forgery, where a backend fetches a location chosen by a user and reaches internal addresses, cross site request forgery, where a browser attaches a user's session cookies to a request initiated elsewhere, and over broad service credentials that let any caller cause reads of storage the caller does not own. The pattern is identical in each case.
AI agents are a natural host for this flaw. An agent runs with credentials for search, storage, messaging, and other systems, and it chooses which tool to call based on text it has read, including retrieved documents and tool output. Content that influences the agent effectively borrows the agent's permissions, which is why injection through content and this problem are usually discussed together.
The remedy is to bind authority to the request rather than to the deputy. Pass the caller's credentials or a scoped, short lived token so that downstream checks apply to the original principal, avoid ambient authority, use capability style references that name a resource and the right to use it together, validate and allowlist any caller supplied target, and record which principal each action was taken for.
Key points
- A privileged program misuses its authority for a weaker caller.
- Arises when identity and authority become separated.
- Includes request forgery and over broad service credentials.
- AI agents are exposed because content steers privileged tool calls.
- Fix by carrying caller authority instead of ambient permissions.
In practice
A reporting service holds database credentials so that it can generate reports for every team. It accepts a report identifier from the caller and returns the result. Because it never checks whether that caller is entitled to the identifier, anyone able to reach the service can read any report. The service is not compromised, only confused, and the fix is an authorization check tied to the requesting user.