---
title: "Confused Deputy: The Old Bug That AI Agents Keep Reintroducing"
description: "The Confused Deputy problem, first documented in 1988, describes a program with legitimate authority being tricked into misusing that authority on behalf of a less-privileged actor. AI agents are particularly vulnerable because they process instructions and untrusted content through the same natural-language channel, making prompt injection straightforward. The post traces this pattern through CSRF, SSRF, and recent attacks like Clinejection, where an issue-triage bot executed an attacker-supplied command from a crafted issue title. That attack led to a poisoned GitHub Actions cache and a compromised npm package downloaded 4,000 times. The fix involves task-scoped short-lived credentials, capability-scoped permissions, credential isolation from the model, and human-in-the-loop approval for high-risk actions."
---

# Confused Deputy: The Old Bug That AI Agents Keep Reintroducing

[Auth0](https://yomu.fyi/company/auth0) · Andrea Chiarelli · Sep 22, 2026

**Type:** Explainer

## Summary

The Confused Deputy problem, first documented in 1988, describes a program with legitimate authority being tricked into misusing that authority on behalf of a less-privileged actor. AI agents are particularly vulnerable because they process instructions and untrusted content through the same natural-language channel, making prompt injection straightforward. The post traces this pattern through CSRF, SSRF, and recent attacks like Clinejection, where an issue-triage bot executed an attacker-supplied command from a crafted issue title. That attack led to a poisoned GitHub Actions cache and a compromised npm package downloaded 4,000 times. The fix involves task-scoped short-lived credentials, capability-scoped permissions, credential isolation from the model, and human-in-the-loop approval for high-risk actions.

## Context

The Confused Deputy problem, first described by Norm Hardy in 1988, occurs when a program with legitimate authority is tricked by a less-privileged actor into misusing that authority. AI agents are particularly vulnerable because they process instructions and untrusted content through the same natural-language channel, making prompt injection straightforward. The post traces the pattern through CSRF, SSRF, and recent real-world attacks like Clinejection, where an issue-triage bot executed an attacker-supplied command from a crafted issue title, leading to a poisoned cache and a compromised npm package downloaded 4,000 times.

## Approach / What changed

Apply least privilege, capability-based security, task-scoped short-lived credentials, capability-scoped permissions, credential isolation from the model, and human-in-the-loop approval to AI agents, as exemplified by Auth0 for AI Agents’ Token Vault and task-scoped authorization.

## Takeaways

- The Confused Deputy problem requires two conditions: an identifier that doesn’t carry access rights, and a deputy whose permissions apply automatically without checking the caller’s authority.
- AI agents are vulnerable because they mix instructions and untrusted content in the same natural-language channel, so a sentence in an email or issue title can trigger unauthorized actions.
- Defenses include task-scoped short-lived credentials, capability-scoped permissions, keeping credentials in a separate deterministic layer the model cannot access, and requiring human approval for irreversible actions.

## FAQ

### What two conditions make the Confused Deputy possible?

The two structural conditions are: first, the identifier used to reference an object (like a filename or URL) does not carry access rights of its own; second, the deputy's permissions apply automatically without checking whether the specific caller is authorized for that action.

### Why are AI agents especially vulnerable to this attack?

An AI agent processes system prompts, user requests, retrieved documents, and tool outputs through the same natural-language channel. A sentence in a GitHub issue title carries the same weight as a direct user command, so an attacker can inject instructions into content the agent reads, causing it to misuse its authority.

### How did the Clinejection attack chain work?

The Clinejection attack in February 2026 used a crafted issue title to trick an issue-triage bot into executing an attacker-supplied command. That foothold was used to poison a GitHub Actions cache, which was then restored by a privileged nightly release workflow, giving the attacker access to an npm publishing token and allowing publication of a tampered package downloaded 4,000 times.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Authorization](https://yomu.fyi/topic/authorization), [Least Privilege](https://yomu.fyi/topic/least-privilege), [Security](https://yomu.fyi/topic/security)

- Source: [Auth0](https://auth0.com/blog/confused-deputy-the-old-bug-that-ai-agents-keep-reintroducing)
- Source URL: https://auth0.com/blog/confused-deputy-the-old-bug-that-ai-agents-keep-reintroducing
- Ingested by Yomu: 2026-09-22T18:00:08.392Z

[Read original post](https://auth0.com/blog/confused-deputy-the-old-bug-that-ai-agents-keep-reintroducing)