# AI agents are a confused deputy with the keys to your kingdom

[Stack Overflow](https://yomu.fyi/company/stack-overflow) · Fabio Salvadori · Jun 17, 2026

**Type:** Problem & solution

## Summary

Attackers recently compromised over twenty thousand Instagram accounts by manipulating Meta's AI support assistant to rebind recovery email addresses without verifying account ownership. This incident illustrates the classic confused deputy security problem, where a privileged process is persuaded by an unprivileged user to perform unauthorized operations. Because large language model interfaces operate purely on natural language and cannot distinguish instructions from data, the model itself cannot serve as an authorization boundary. Securing AI agents requires verifying caller identity through external policy checks against authenticated sessions rather than relying on chat context or prompt engineering. Teams must enforce least privilege with short-lived scoped credentials, place irreversible actions behind hard policy gates or human approvals, and maintain audit trails of agent actions.

## Context

Attackers compromised over twenty thousand Instagram accounts by instructing Meta's AI support assistant to attach an attacker-controlled email address to target accounts and trigger password resets, exploiting missing verification checks previously handled by human support workers.

## Approach / What changed

Enforce authorization externally rather than inside the model by checking authenticated session principals before executing tool calls. Grant agents scoped, short-lived permissions per action and resource, place irreversible operations behind human approval or hard policy gates, and record complete provenance including principal, session, and prompt.

## Takeaways

- LLM agents act as confused deputies because natural language interfaces lack caller identity context and models cannot reliably separate instructions from ingested data.
- Authorization must live outside the model in an external policy layer that verifies whether the authenticated session principal has permission to perform the requested action on the target resource.
- Irreversible actions such as payments, deletions, and account recoveries require non-model policy gates or human approvals alongside action provenance logging for real-time incident detection.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [LLMs](https://yomu.fyi/topic/llm)

[Read original post](https://stackoverflow.blog/2026/06/17/ai-agents-expose-the-security-checks-you-never-actually-wrote)