AI Confused Deputy Lab: Turn the Agent's Privileges Against Its User

This article describes the confused-deputy problem in agentic AI systems, where a privileged agent performs unauthorized actions on behalf of low-privilege users without verifying the user's own permissions. The article uses FinanceBot—a financial reconciliation tool with system-level access to all accounts—as a concrete example, demonstrating how an attacker can exploit the agent's broad privileges to transfer funds from other users' accounts. This vulnerability is critical because AI agents commonly hold expansive tool permissions and execute user requests directly, creating a systematic authorization failure that maps to OWASP LLM06 Excessive Agency.

• Core authorization flaw in agent designThe fundamental problem is that agents authorize actions against their own privileges rather than the end user's. FinanceBot checks 'can the agent call the transfer tool?' but never checks 'can Alice move funds from Bob's account?' This conflates the agent's capabilities with the user's permissions, allowing the agent to become a confused deputy that misuses authority it holds.
• Practical attack on FinanceBotA low-privilege user (Alice) can request the agent transfer money from another user's account (Bob's) to their own. Because FinanceBot holds system-level privileges on all accounts and performs no per-user authorization checks, it executes the transfer using its own elevated access, completing an action Alice could never perform directly.
• Why AI agents are vulnerableAI agents typically receive standing, broad tool permissions and act on whatever users request without per-action authorization. Unlike traditional privilege escalation attacks, the agent voluntarily performs the malicious action because its design treats any user request as implicit authorization to use its own capabilities, bypassing the need for explicit user-level permission checks.
• Connection to OWASP LLM06The article identifies confused-deputy misuse as the core of OWASP LLM06 Excessive Agency—granting agents more capability or autonomy than warranted. The common design mistake is giving an assistant broad, standing tool permissions and letting it act for any caller without distinguishing between what the agent can do and what each specific user is allowed to do.
• Identity propagation defenseThe primary defense is to propagate the user's identity into every tool call and authorize against it. Instead of allowing the agent to act on its own privileges, scope tools to the caller so the agent can only perform actions the current user could execute themselves, and avoid standing elevated privileges in favor of just-in-time access per action.
• Logging and confirmation requirementsHigh-risk actions—particularly cross-account transfers or high-value operations—should require explicit logging and confirmation. This creates an audit trail and a manual checkpoint that can catch confused-deputy attacks before funds or data move.
• Historical context and prevalenceThe confused-deputy problem predates AI and originally described privileged programs tricked into misusing authority on behalf of less-privileged callers. The article notes it is acute in agentic AI because agents often hold broad tool permissions and act directly on user requests with no per-action authorization, making the pattern especially dangerous in modern AI systems.

Bottom line: Every action an agent performs must be authorized against the specific end user's permissions, never the agent's own capabilities. If an agent holds privileges its users do not possess, the system must verify the user's authorization for each action—if it does not, the agent is a confused deputy waiting to be exploited.