AI agents are a confused deputy with the keys to your kingdom

Summary

Attackers recently compromised over twenty thousand Instagram accounts by manipulating Meta's AI support assistant to rebind recovery email addresses without verifying account ownership. This incident illustrates the classic confused deputy security problem, where a privileged process is persuaded by an unprivileged user to perform unauthorized operations. Because large language model interfaces operate purely on natural language and cannot distinguish instructions from data, the model itself cannot serve as an authorization boundary. Securing AI agents requires verifying caller identity through external policy checks against authenticated sessions rather than relying on chat context or prompt engineering. Teams must enforce least privilege with short-lived scoped credentials, place irreversible actions behind hard policy gates or human approvals, and maintain audit trails of agent actions.

Context

Attackers compromised over twenty thousand Instagram accounts by instructing Meta's AI support assistant to attach an attacker-controlled email address to target accounts and trigger password resets, exploiting missing verification checks previously handled by human support workers.

Approach / What changed

Enforce authorization externally rather than inside the model by checking authenticated session principals before executing tool calls. Grant agents scoped, short-lived permissions per action and resource, place irreversible operations behind human approval or hard policy gates, and record complete provenance including principal, session, and prompt.

Takeaways

• LLM agents act as confused deputies because natural language interfaces lack caller identity context and models cannot reliably separate instructions from ingested data.
• Authorization must live outside the model in an external policy layer that verifies whether the authenticated session principal has permission to perform the requested action on the target resource.
• Irreversible actions such as payments, deletions, and account recoveries require non-model policy gates or human approvals alongside action provenance logging for real-time incident detection.

Related reading

• Docker · May 18, 2026

  Coding Agent Horror Stories: The Security Crisis Threatening Developer Infrastructure

  Autonomous AI coding agents increasingly handle developer workflows, but their execution model introduces critical security risks. Operating with the executing user's full permissions, these agents can read ambient secrets, inherit cloud credentials, and run destructive shell commands without human intervention. Documented incidents between October 2024 and February 2026 reveal systemic hazards, including unintentional home directory deletions and increased security vulnerabilities in generated code. To address these vulnerabilities, Docker Sandboxes isolate agent execution within dedicated microVMs, preventing access to the host filesystem and blocking common credential paths by default. Routing changes through Git worktrees and restricting network egress ensures that agent actions remain strictly bounded and reviewable before affecting main branches or production infrastructure.

  Jennifer Kohl

• Salesforce · Aug 20, 2026