Preventing Confused Deputy Attacks in AI Agent Deployments

AI agents expose the security checks you never actually wrote

Meta’s AI support assistant allowed attackers to reroute recovery emails and hijack over twenty thousand Instagram accounts. The system functioned exactly as designed, but lacked the human discretion previously used to verify account ownership.

Why This Matters

The technical reality is that LLM agents act as ‘confused deputies,’ using their own high-level privileges to execute requests from unauthenticated users. Because natural language interfaces do not inherently carry identity, relying on a ‘better model’ or improved prompting cannot fix authorization gaps; the decision to permit an action must exist in a policy layer outside the LLM’s control to prevent large-scale unauthorized access.

Key Insights

• The ‘Confused Deputy’ problem, documented since 1988, occurs when a privileged process is manipulated by a less-privileged party to perform actions on its behalf.
• Agentic risk is scaling rapidly: Gartner projects 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from under 5% at the start of the year.
• Authorization must shift from session-based trust to per-action verification (e.g., verifying if a specific principal owns a specific account before executing a password reset).

Working Examples

Vulnerable implementation where authorization is implicitly granted to whoever can call the function.

def add_recovery_email(account, new_email):
    account.recovery_email = new_email # nothing here ties to the caller
    send_reset_link(new_email)

Secure implementation utilizing a verified principal from an authenticated session outside the chat context.

def add_recovery_email(account, new_email, principal):
    if not principal.owns(account): # who is actually asking, verified
        raise Unauthorized("session not authenticated as the account owner")
    account.recovery_email = new_email
    send_reset_link(new_email)

Practical Applications

References:

• https://stackoverflow.blog/2026/06/15/ai-agents-expose-the-security-checks-you-never-actually-wrote/