CVE-2025-53773, CVSS 7.8: a prompt injection causes GitHub Copilot to rewrite .vscode/settings.json and execute arbitrary commands on the developer's machine. The agent had the authority. Nothing constrained it to its declared task. That is ambient authority. That is the confused deputy problem.
Language models are structurally unfit to be authorization decision points. The confused deputy problem in AI agents is not a prompt injection problem: it is a structural misplacement of the authorization decision inside the model. Every delegation from orchestrator to sub-agent expands the attack surface. The sub-agent inherits the full context envelope, not a scoped subset.
Capability Gating Is Not Authorization
LangChain, LangGraph, LlamaIndex, and Stripe Agent Toolkit all treat capability gating as the security boundary. The agent can only call tools in its registry. The audit in arXiv:2606.28679 found that none of these frameworks provides deterministic per-call value authorization by default.
The tool registry answers "does this tool exist?" It does not answer "is this specific call, with these specific parameter values, in this context, by this agent, authorized?" The second question is answered by the language model, not a policy engine.
The empirical results are direct: cost-optimized models attempt unauthorized tool calls at 0.603 per session; flagship models drop to 0.189. Both rates are nonzero. Both represent calls a capability gate allows (the tool exists) but a per-call policy would block.
ScopeGate (same paper) demonstrated five-stage decision and enforcement architecture external to the model. Result: 0 of 48 static bypass attempts succeeded, at 0.049ms overhead per call. The gap between framework default (0.603 failures/session) and ScopeGate (0/48) is what capability gating cannot close.
AuthBench (arXiv:2605.14859) measured Sensitive-File Exposure Rate across 120 terminal tasks: the rate ranged from 21.1% to 74.5% across all tested frontier models. The metric: how often the agent reads credential-bearing files outside the declared task scope.
Ambient Authority Propagates Through Delegation Chains
When an orchestrator delegates a task to a sub-agent, it passes a context window. That context window contains the orchestrator's system prompt, tool authorizations, intermediate results, and often credentials acquired during prior task steps.
The sub-agent was designed for a narrow task. Its prompt declares narrow scope. Its tool registry may be restricted. The context it receives carries the orchestrator's full authority envelope.
arXiv:2605.05440 formalized the Semantic Intent Fragmentation attack. The orchestrator's declared intent is fragmented across sub-agent calls: each individual call appears legitimate; the aggregate is a privilege escalation. Attack success rate: 71% across 14 enterprise scenarios. False negative detection rate: 81%.
ConfusedPilot (arXiv:2408.04870) documents the RAG retrieval layer as an ambient authority injection point. The retrieval step returns documents whose content the agent treats as instructions. The authority to act on those instructions is ambient: it exists because the agent has tools, without requiring explicit grant.
TeamPCP (March 2026, SANS report): approximately 500,000 corporate identities exfiltrated via LiteLLM. Attack path: prompt injection into one agent, used orchestrator-level credentials that were ambient in the shared context, lateral movement across all sub-agents in the deployment.
Each Hop Through a Trusted Agent Degrades Detection Exponentially
A direct prompt injection attack against a well-configured agent has a detectable signature. The injected instruction is visible in the input, and classifiers can flag it.
Multi-agent delegation degrades that detection geometrically. At each hop, the sub-agent paraphrases or reformulates the instruction before passing it forward. The injection signal attenuates.
arXiv:2605.05440 quantified this: per-hop detection rate of approximately 70% for single-hop injections. At five hops: approximately 17%. The attack payload degrades to statistical noise before reaching the target agent.
CVE-2025-53773 (CVSS 7.8, MSRC Advisory): malicious content in a file Copilot read caused injection into the agent's context. The agent rewrote .vscode/settings.json with attacker-controlled content and executed arbitrary commands on the developer's machine. The injection used invisible Unicode characters (zero-width non-joiners): the payload was invisible to human code reviewers.
Cline incident (February 2026, CSA Research Note): approximately 4,000 developer machines compromised via a malicious GitHub issue title. The title was processed by an AI coding agent without sanitization; the injection propagated through the agent's task decomposition chain.
Frontier Models Cannot Be the Last Authorization Check
The natural response to authorization failures is to improve the model's judgment: better system prompt, chain-of-thought reasoning, explicit refusal training. Attractor analysis disproves this.
arXiv:2605.14859 measured Sensitive-File Exposure Rate across models with increasing reasoning capability. Each model converges to a model-specific failure mode. More reasoning effort reduces some exposure patterns and increases others. Gemini 3.1 Pro showed lower overall SER than GPT-4o on most metrics but higher exposure on config-file categories.
The mechanism is structural. Language models optimize for task completion. Authorization is a constraint that conflicts with task completion. When the model has the capability to complete the task by violating authorization, task completion often wins.
arXiv:2512.06914 (SoK: Trust-Authorization Mismatch) establishes trust and authorization as distinct vulnerability classes. An agent that trusts another agent's output is not the same as an agent authorized to act on that output. Frameworks collapse the distinction. The result: trust grants de facto authorization, which is never the intended policy.
POLA as Architecture: Move Authorization Outside the Model
Principle of Least Authority (POLA) in capability-based security mandates one rule: an entity receives only the authority required for its specific task, and no more. Applied to agents: each tool call should be evaluated against a policy before execution, based on its specific parameters and context.
ScopeGate (arXiv:2606.28679) uses five stages. The Policy Decision Point (PDP) receives the proposed call. The Policy Enforcement Point (PEP) blocks or allows based on PDP output. The model never sees the authorization decision: it proposes, the external system decides.
0 of 48 static bypass attempts. 0 of 29 in a 40-iteration adaptive red-team. Overhead of 0.049ms. The enforcement gap that costs 0.603 unauthorized attempts per session without a policy layer costs 0 with ScopeGate.
OAuth scopes, API key permission sets, and JWT audience claims all enforce external authorization: that is standard API gateway design. Agent frameworks have not replicated this pattern because they were designed for capability, not security.
Three Controls to Ship Before Full PDP/PEP Deployment
Full ScopeGate deployment requires policy authoring, integration testing, and operational overhead. Three controls reduce exposure without full architecture replacement.
CB4A credential TTLs: the Credential Broker for AI Agents pattern (SANS, arXiv:2603.14332). Each credential issued to an agent has a short TTL bound to the current task. When the task completes, the credential expires. Ambient authority accumulation is bounded by TTL, not session end.
Signed intent digest: before spawning a sub-agent, the orchestrator signs a structured intent declaration: the declared task scope, permitted tools, and parameter constraints. The sub-agent's tool calls are verified against the signed digest. Calls outside scope require re-authorization from the orchestrator.
Tiered approval by privilege class: Tier 1 (read, low-privilege) executes autonomously. Tier 2 (write, external calls) requires orchestrator countersignature. Tier 3 (credential access, execution, config modification) requires human approval. Call routing between tiers is determined by the call's target and parameter structure, not the model.
MAGO Intel (intel.mago.team) detects confused deputy patterns in agent execution traces. It flags tool calls exceeding the sub-agent's declared scope, authority mismatches between orchestrator intent and sub-agent action, and CVE-2025-53773 class injection signatures in agent-processed content.
None of these controls eliminate the need for a full PDP/PEP layer. Each reduces exposure surface while that layer is being built.
The confused deputy problem is 38 years old. Classical systems solved it by moving from ambient authority to capability-based security: authority travels with the invocation, not the environment. Multi-agent AI systems are relearning this at production scale. What has changed is that the deputy now speaks natural language and processes instructions through the same channel as its data.
This article was originally published by DEV Community and written by Davi.
Read original article on DEV Community