Confused Deputy Problem in AI Agents
The short answer · 13 words
In short
Security issue where an intermediary uses its own permissions for an unauthorized order.
Flow-alerta.cab (2026): Confused Deputy Problem in AI Agents. https://flow-alerta.cab/en/glossar/confused-deputy-problem-in-ai-agents. Editorially reviewed on: 09 October 2026.
How much detail would you like?
Practical
Relevant for AI agents with plugins, APIs and writing tools, because delegated actions require clear identity and authorization.
Hypothetical example: An agent with access to customer data receives a manipulated instruction via a plugin and tries to retrieve data outside of the permitted order.
Bind entitlements to triggering identity and specific task, apply Least Privilege and confirm irreversible or cross-border actions more strongly.
At a glance
- Core
- A service, plugin or agent has its own access rights. If the identity and purpose of a request are not linked to the authorisation, this intermediary may inadvertently use its rights for an unauthorised assignment.
- Use
- Relevant for AI agents with plugins, APIs and writing tools, because delegated actions require clear identity and authorization.
- Example
- Hypothetical example: An agent with access to customer data receives a manipulated instruction via a plugin and tries to retrieve data outside of the permitted order.
- Limits
- Only authorize the agent instead of any tool action; lose user identity; use wide continuous tokens; treat indirect input as trustworthy.
In context
Authorization
Deciding whether an entity may use a particular resource or action.
Tool Use / Function Calling
Function Calling allows a model to suggest tool calls that an application executes in a controlled manner.
Prompt Injection
Prompt injection is the attempt to direct an AI via third-party content to unwanted behavior.
Questions about this term
Is this just an AI problem?
No.
Why is it relevant for agents?
Because they act with foreign tools and delegated rights.
Does Least Privilege help?
Yes.
All details and background
A service, plugin or agent has its own access rights. If the identity and purpose of a request are not linked to the authorisation, this intermediary may inadvertently use its rights for an unauthorised assignment.
ELI5 – Explained simply
Someone without a key persuades a helper with a key to open a door for him.
Why it matters in practice
Relevant for AI agents with plugins, APIs and writing tools, because delegated actions require clear identity and authorization.
Example
Hypothetical example: An agent with access to customer data receives a manipulated instruction via a plugin and tries to retrieve data outside of the permitted order.
Pitfalls and limits
- Only authorize the agent instead of any tool action; lose user identity; use wide continuous tokens; treat indirect input as trustworthy.
Origin & history
The Confused Deputy problem is a classic security concept. In agent systems, it occurs again when agents, plugins, and tools have different identities and rights.
Use in mid-sized companies
- Bind entitlements to triggering identity and specific task, apply Least Privilege and confirm irreversible or cross-border actions more strongly.
Related terms
- Least Privilege
- Authorisation
- Tool Use
- Prompt injection
- AI agents
- OAuth 2.0
Matching Flow-alerta service
AI assistants & automationAI assistants & automation: test a suitable process with clear rights and human test points.Matching tool / use case
View use casesUse Case: Secure an agent that accesses CRM, email and files via plugins.Sources
- learn.microsoft.comMicrosoft Learn, Identity, Access, and Least Privilege for AI
Quellenprüfung: 09.10.2026. Definition und dokumentierte Einordnung abgeglichen; Beispiele beschreiben mögliche Anwendungen.
Editorially reviewed on: