Definition
The AWS IAM User Guide defines the problem this way.The confused deputy problem is a security issue where an entity that doesn’t have permission to perform an action can coerce a more-privileged entity to perform the action.The deputy is only acting within the permissions it was given, exactly as instructed. But it lacks the context of who it’s acting for right now, so authority gets granted indirectly and unintentionally.
The confused deputy problem in AI agents
Two properties of AI agents make permissions easy to mismanage.- The permissions available to an agent are wide ranging: service accounts, API keys, connected MCP servers, RAG, and more
- The same permissions are often used without regard to who issued the instruction
Concrete examples
An internal MCP server configured with a shared machine user
When you build an MCP server against an internal knowledge base, the easiest approach is to grant uniform permissions through a machine user or service account. But the knowledge base holds confidential documents that only certain departments such as HR or finance can read. Configure that MCP server with a machine user that can read everything, expose it to all employees, and someone in another department can use that server to reach documents their own account permissions would never allow.RAG that spans departments
RAG is especially prone to the confused deputy problem. If the original permission metadata is lost when the index is built, no access boundary exists at retrieval time, and the system can’t tell whether the person issuing the query was ever allowed to read the document.Shared credentials in a multi-user environment
Agent platforms serving multiple users sometimes store access tokens for third-party services in a shared credential store. Without controls over which user may use which credential, one user can start a session that specifies another user’s credential. The agent then reaches the external service with the credential owner’s permissions rather than the requester’s. Engineers must not read the HR team’s personnel records, and the sales team has no need to reach the development team’s internal repositories. Notion, Slack, GitHub, and similar services already enforce these boundaries through their own access controls, so being able to use someone else’s permissions bypasses that enforcement entirely.Concepts it gets confused with
Least privilege
Following least privilege does not solve the confused deputy problem. Least privilege tells you to grant a deputy no more permission than it needs, which governs the total amount of the deputy’s authority. The confused deputy problem asks about attribution rather than amount: does this authority belong to the person currently asking?Privilege escalation
The confused deputy problem is classified as a form of privilege escalation, but unlike ordinary escalation, neither the attacker nor the deputy escalates anything. The attacker’s permissions never change, and the deputy uses only the authority it already held. Because of that, the activity looks like normal operation in permission audits and logs, which makes it hard to detect.Prompt injection
These are independent problems, and the damage compounds when both hold at once. Prompt injection is an attack that makes an agent execute instructions it was never meant to. The confused deputy problem is a structure in which an agent exercises authority that doesn’t belong to the requester. With the confused deputy problem, confidential data leaks with no injection at all, because a legitimate user asking a legitimate question is enough. Conversely, if authority is correctly bound to the requester, a successful prompt injection still can’t push the agent outside that requester’s own permissions. Fixing attribution also limits the blast radius of prompt injection.Countermeasures
Two principles underpin everything else.- Handle only data that the user and every viewer of the output already has permission to see. Otherwise, grant access through an authorization mechanism such as OAuth that respects the original permissions
- Based on the data and permissions the agent handles, control who may use it and what access its output destination has