Confused Deputy Problem
The confused deputy problem is a class of privilege escalation in which a program that holds legitimate authority is tricked by a less-privileged party into misusing that authority on the attacker's behalf. The deputy retains its normal authority and is simply misdirected about whose request it is serving. The term dates to a 1988 paper by Norm Hardy. In AI systems, an agent or MCP server holding broad credentials is the deputy: an attacker who plants an instruction the agent will read (in a document, a webpage, or a tool description) can make the agent perform actions the attacker could never perform directly.
How the confusion happens in agentic AI
An AI agent authenticates to its tools with its own credentials, which are usually broad so the agent can be useful. When the agent ingests untrusted content, a retrieved web page, an email, a file, that content can contain instructions. If the agent treats those instructions as if they came from its authorized operator, it will act on them using its own authority. A support agent with database access, told by a poisoned ticket to dump customer records, becomes the confused deputy that runs the query no external attacker could have run.
How a policy boundary contains it
Containing a confused deputy means checking authority per action, against the identity that should be driving the request, rather than trusting the deputy's standing credentials. For AI traffic over HTTP, DeepInspect evaluates each model and tool call against per-role and per-route policy tied to the verified identity context, so a request to exfiltrate records fails the policy check even though the agent technically holds the credential to make it. The per-decision audit record then shows the attempted action and the verdict that stopped it.
Related reading
- MCP Confused Deputy: Why the Server Acting on the User Is the Wrong Principal
The confused deputy attack describes the case where a privileged intermediary acts on behalf of a less-privileged caller and ends up doing things the caller could not have done directly. In the Model Context Protocol (MCP) world, the confused deputy lives in the MCP server. The MCP server holds credentials for upstream tools and acts on behalf of an LLM client. When the client identity is not propagated to the upstream calls, the upstream services see the MCP server, not the user, and authorization decisions get made against the wrong principal. This article walks the attack pattern, the architectural cause, the controls a policy gateway enforces at the MCP boundary, and the operational checklist.
- AI Agent Authorization: NIST Pillar 2 at the Request Boundary
AI agent authorization is the per-request decision about whether a specific caller, against a specific resource, under a specific policy, is allowed to act. NIST calls it delegated authority. Most enterprise AI deployments solve authentication and skip authorization.