Notifications
Clear all
Topic starter
11/08/2026 3:19 pm
TL;DR: AI agents can be tricked into executing attacker-controlled instructions from tickets, email, or calendar invites using their own privileges, with EchoLeak, ConfusedPilot, and Copilot incidents showing how the pattern scales across enterprise workflows, according to Bishop Fox. The core failure is not broken authorization but a broken trust boundary between data and instructions, so governance must assume untrusted input can steer privileged action.
NHIMG editorial — based on content published by Bishop Fox: Confused Deputy attacks in AI agents and the otto-support walkthrough
By the numbers:
- NHIs now outnumber human identities by 144:1 in enterprise environments, a 44% increase year-over-year driven by AI agents, CI/CD automation, and third-party integrations.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams prevent AI agents from acting on malicious input?
A: Security teams should treat every external prompt, email, ticket, or chat message as untrusted input until it is validated against policy.
Q: Why do confused deputy attacks matter for IAM and NHI governance?
A: They show that valid credentials are not enough if the system cannot tell trusted intent from malicious instruction.
Q: What do teams get wrong about least privilege for AI agents?
A: They often stop at permission scope and ignore behavioural scope.
Practitioner guidance
- Separate data channels from instruction channels Classify ticket text, email bodies, calendar content, and other untrusted inputs as data only unless they pass explicit provenance checks.
- Scope tools to individual task realms Register only the tools needed for a single workflow and keep read, write, and destructive operations in separate permission sets.
- Require human approval for irreversible actions Place approval gates before data export, external messaging, account changes, or any action that could create a durable side effect.
What's in the full article
Bishop Fox's full blog covers the operational detail this post intentionally leaves for the source:
- A walk-through of the otto-support CTF exploitation path, including reconnaissance, IDOR abuse, and privilege escalation into support-agent access
- A deeper look at the multi-turn and multi-session behaviours that made the confused deputy scenario exploitable
- Specific mitigation layering, including per-task tool registration, read versus write separation, and approved-destination egress controls
- The case-study breakdowns behind EchoLeak, ConfusedPilot, and the Copilot calendar incidents
👉 Read Bishop Fox's analysis of confused deputy attacks in AI agents →
Confused deputy attacks in AI agents: are your controls keeping up?
Explore further
11/08/2026 3:31 pm
Confused deputy is an authorisation failure caused by poisoned instruction channels. The key break is not that the agent lacked permission, but that permission was exercised against attacker-controlled input. That changes the governance problem from access issuance to instruction provenance, which traditional IAM design does not model well. Practitioners should treat content channels as part of the identity perimeter.
A few things that frame the scale:
- NHIs now outnumber human identities by 144:1 in enterprise environments, a 44% increase year-over-year driven by AI agents, CI/CD automation, and third-party integrations, according to The NHI and Secrets Risk Report.
- Nearly half of all exposed secrets reside outside code repositories, in CI/CD logs, collaboration tools, and messaging platforms.
A question worth separating out:
Q: Who is accountable when an AI agent exfiltrates data after being manipulated by attacker content?
A: Accountability usually spans the team that granted the agent its privileges, the owners of the connected tools, and the programme that failed to constrain instruction channels. The user attribution in logs may be misleading, so governance must assign responsibility based on how the agent was authorised and what trust boundaries were missing.
👉 Read our full editorial: Confused deputy attacks are weaponizing AI agent privileges
