Confused Deputy Problem

The fundamental flaw: the deputy possesses legitimate authority (e.g., write access to a file, database credentials) but lacks the ability to independently verify the intent behind a request. The attacker exploits this gap by crafting a request that the deputy executes using its own privileges, not the attacker's. The deputy is not malicious—it is confused about the true origin or purpose of the command.

The canonical illustration involves a compiler with write access to a billing file. A user requests compilation of a program, specifying a debug log file. The attacker provides a filename that is actually the path to the billing file. The compiler, running with elevated write privileges, overwrites the billing file with debug output. The compiler's authority was misused because it failed to distinguish between a user-supplied parameter and a protected resource.

In capability-based systems, a deputy holds a capability (an unforgeable token of authority) to access a resource. The attacker tricks the deputy into exercising its capability on the attacker's behalf. For example, a client sends a request to a server with a capability to write to file A. The attacker modifies the request to point to file B, and the server uses its own capability to overwrite file B. The server failed to validate that the invoked capability matched the intended operation.

In web security, the Confused Deputy manifests as Cross-Site Request Forgery (CSRF) . A user authenticated to their bank visits a malicious site. The malicious site triggers a request to the bank's API using the user's active session cookies. The bank's server, the deputy, processes the request using the user's authenticated session, transferring funds without the user's genuine intent. The browser automatically attaches ambient authority (cookies) to the request.

In multi-agent systems, the Confused Deputy problem is amplified. An orchestrator agent with broad tool access may receive a subtask from a less-privileged agent. If the orchestrator executes the subtask without verifying the originating agent's permissions, an attacker who compromised the subordinate agent can leverage the orchestrator's higher privileges. This creates a privilege escalation chain across the agent mesh.

The primary defense is complete mediation: every access request must be validated against the original requester's permissions, not the deputy's. Implementations include:

• Capability-based security: Passing explicit, attenuable tokens rather than relying on ambient authority.
• Access Control Lists (ACLs) : Checking the original subject's identity on every operation.
• Confused Deputy-Resistant APIs: Designing interfaces that require the caller to prove authorization for the specific resource being accessed.

A classic web-based confused deputy where a browser (the deputy) automatically attaches session cookies to a malicious request. The attacker crafts a hidden form on evil.com that submits to bank.com/transfer. Because the browser holds valid authentication cookies for the bank, it dutifully executes the transaction with full user authority.

• Deputy: The user's browser
• Authority: Session cookies and HTTP authentication headers
• Mitigation: CSRF tokens, SameSite cookie attributes, and Origin header validation

The sudo command is a canonical confused deputy in Unix systems. A user with restricted sudo permissions to edit a specific file can be tricked into overwriting /etc/passwd or /etc/shadow if the allowed command permits symlink following or argument injection.

• Deputy: The sudo binary running with root privileges
• Authority: Setuid root execution context
• Attack Vector: sudoedit symlink races, wildcard expansion in allowed commands

A cloud-native confused deputy where an application server with access to internal metadata services is tricked into fetching attacker-specified URLs. In AWS, a vulnerable EC2 instance can be coerced into retrieving http://169.254.169.254/latest/meta-data/iam/security-credentials/ — exposing temporary IAM role credentials.

• Deputy: The application server with internal network access
• Authority: IAM role attached to the EC2 instance profile
• Impact: Cloud account takeover via credential exfiltration

In autonomous agent systems, an LLM agent with tool-calling capabilities acts as a confused deputy when prompt injection causes it to invoke tools with attacker-controlled parameters. An agent authorized to send emails can be tricked into exfiltrating sensitive data by a prompt hidden in a webpage it summarizes.

• Deputy: The LLM agent with function-calling authority
• Authority: API keys, database connections, and execution permissions
• Defense: Tool-use sandboxing, parameter validation, and human-in-the-loop approval gates

An OAuth redirect URI confusion attack where a malicious client tricks the authorization server into delivering an authorization code to an attacker-controlled endpoint. The authorization server (deputy) holds the authority to issue tokens but is confused about the legitimate recipient.

• Deputy: The OAuth authorization server
• Authority: Ability to issue access and refresh tokens
• Mitigation: Strict redirect URI validation, PKCE (Proof Key for Code Exchange), and DPoP binding

A confused deputy scenario where a compromised pod with RBAC impersonation permissions is tricked into acting on behalf of a cluster administrator. An attacker who gains access to a service account with impersonate verbs can execute commands as system:admin, escalating from a single namespace to full cluster control.

• Deputy: The Kubernetes API server
• Authority: Impersonation RBAC rules
• Detection: Audit log monitoring for Impersonate-User header usage

A comparison of two fundamental authorization models:

• ACLs: Associate permissions with the object being accessed. A file has a list of users who can read it. This is ambient authority—the system checks the requesting user's identity against the list. Vulnerable to confused deputy if a program acts on behalf of a user without proper validation.
• Capabilities: Associate permissions with the accessing entity. A process holds a token that grants read access to a specific file. No global identity check is needed. The token itself is the proof of authorization. This model is inherently resistant to the confused deputy problem because authority is explicit and transferable only by possession of the token.