The confused deputy problem

Norm Hardy described the problem in 1988 using a compiler.

The compiler ran with permission to write to a billing file, because it needed to record usage. It also accepted an output filename from the user. A user could pass the billing file’s path as their output filename, and the compiler — doing exactly what it was told, with authority it legitimately held — would overwrite it.

The compiler was not compromised. It had no bug in the ordinary sense. It was a deputy acting on someone’s behalf, and it was confused about whose authority it was using: it used its own where it should have used the caller’s.

Why it keeps happening

The pattern needs three things: a program with more authority than its caller, an input that designates a resource, and no mechanism tying the designation to the caller’s rights. That combination is everywhere. Every setuid binary is a candidate. So is every service that takes a URL, every webhook handler, and every API that accepts a resource identifier from a client.

Capability-based security closes the class outright: if the caller must hand over a capability that both names the resource and carries the right to use it, there is no way to name something the caller could not already reach.

AI agents are the deputy

An AI agent is a confused deputy with a language model in the deputy’s chair, and it is a particularly good one for an attacker.

It holds broad authority — your files, your network, your credentials. It processes input from parties who are not you: an issue, a dependency README, a scraped page, a tool result. And it has no reliable mechanism to distinguish “content I was asked to look at” from “instructions I was given”, because to a language model both are tokens in the same context.

That is prompt injection, and describing it as a confused deputy problem is more useful than describing it as a prompting problem, because it points at the fix. Thirty-five years of work on this class says the same thing: you do not fix a confused deputy by asking it to be less confused. You fix it by making sure the authority it holds is bounded by what the current task should be allowed to touch.

What that means practically

The agent will be persuaded eventually. Assume it. Then make the persuasion worthless: the instruction still has to become a filesystem, network, execution or capability operation, and that operation still has to pass a policy that does not read English.

See prompt injection containment for what that looks like in practice.