The deputy is a service or application that can access resources the requester cannot. If it treats untrusted instructions as authority, it may perform an action that the requester was never entitled to perform.
In AI applications, an agent can become a deputy when it invokes powerful tools based on model-controlled input. Enforced identity checks and trusted application constraints help ensure that tool access stays within the user's actual permissions.
ELI5
A confused deputy attack is like persuading a helpful staff member to open a locked room for someone who is not allowed inside. The staff member has a real key but uses it for the wrong person's request.
For example, an AI help desk may be able to retrieve account documents. It should check that the signed-in user is allowed to see the requested document instead of trusting a name or account number written in the message.
Does the system need stolen credentials to be a confused deputy?
No. The problem can involve misuse of the system's own legitimate authority rather than theft of its credentials.
How can an application reduce this risk?
Bind requests to verified identity and enforce allowed resources and actions outside the agent's control.
