Topic starter
11/08/2026 3:19 pm
TL;DR: AI agents can be tricked into executing attacker-controlled instructions from tickets, email, or calendar invites using their own privileges, with EchoLeak, ConfusedPilot, and Copilot incidents showing how the pattern scales across enterprise workflows, according to Bishop Fox. The core failure is not broken authorization but a broken trust boundary between data and instructions, so governance must assume untrusted input can steer privileged action.
Editorial analysis by NHI Mgmt Group, based on content published by Bishop Fox: “Otto Support - The Confused Deputy”.
Key questions
Q: What breaks when an AI agent acts on poisoned content?
A: The failure is not limited to a bad answer.
Q: Why do confused deputy attacks happen even when authorisation is working?
A: Authorisation can be correct while instruction provenance is wrong.
Q: How can organisations reduce confused deputy risk in agentic AI?
A: By shrinking the authority granted to the agent and making every tool and data connection explicit.
Practitioner guidance
- Segment instruction sources from task data Treat tickets, email, calendar content, and similar inbound text as untrusted inputs that must not directly influence privileged tool calls without explicit mediation.
- Scope tool access per task Register only the minimum tools an agent needs for a specific workflow, and do not provision broad tool sets to a single agent identity.
- Restrict direct MCP pathways Limit which identities can talk to the MCP server directly, and route high-risk actions through a controlled policy layer instead of free-form command execution.
Bottom line: Confused deputy attacks exploit trusted AI agents by feeding them attacker-controlled content that the agent then treats as legitimate instruction.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:31 pm
Confused deputy is an identity trust problem before it is an AI problem: the agent is not breaking its permissions, it is applying them to untrusted instruction sources. That distinction matters because many programmes still assume that a valid session or a valid task context is enough to justify action. In practice, the source of instruction must be treated as part of the identity decision, not as harmless payload. Practitioners should govern agent intent as rigorously as agent access.
A question worth separating out:
Q: What should teams do immediately after a confused deputy incident?
A: Contain the agent’s tool access, review the instruction source that triggered the action, and check for downstream data exposure or workflow changes. Then reassess which integrations allowed attacker-controlled content to become executable intent and narrow those pathways before restoring broad access.
👉 Read our full editorial: Confused deputy attacks are weaponizing AI agent privileges