Otto Support - The Confused Deputy
Summary
A "Confused Deputy" attack occurs when an AI agent, processing attacker-controlled content like a support ticket or email, executes embedded instructions using its own elevated privileges instead of the attacker's. This vulnerability, a mirror image of SSRF, allows attackers to weaponize an agent against its user, with audit logs showing user authorization. Recent incidents like EchoLeak, ConfusedPilot, and Microsoft Copilot calendar exploits in 2025 and 2026 demonstrate this at enterprise scale. The otto-support CTF challenge reproduces this scenario, showing how an attacker can poison tickets via Insecure Direct Object Reference (IDOR) and escalate privileges to a support-agent role by exploiting a metadata service, deceiving the LLM into performing unauthorized actions.
Key takeaway
For AI Security Engineers designing agentic systems, you must prioritize layered defenses against "Confused Deputy" attacks. Implement strict per-task tool registrations with least privilege, ensuring read-only operations lack destructive capabilities without human oversight. Additionally, enforce network egress controls to restrict data exfiltration to approved destinations, significantly reducing the impact of compromised agent instructions.
Key insights
AI agents can be weaponized by attacker-controlled content, executing malicious instructions with their own privileges.
Principles
- Agents can execute unauthorized actions despite valid permissions.
- Trust breaks down when agents act on untrusted inputs.
- Layered security controls are essential for mitigation.
Method
Attackers can exploit IDOR to poison tickets and use metadata services for privilege escalation, deceiving LLMs into unauthorized actions.
In practice
- Separate data from instructions using prompting/markup.
- Restrict per-task tool registrations for agents.
- Implement network egress controls for data.
Topics
- Confused Deputy
- AI Agent Security
- Privilege Escalation
- Insecure Direct Object Reference
- Microsoft Copilot
- Network Egress Controls
Best for: AI Security Engineer, AI Engineer, MLOps Engineer
Related on AIssential
See Counsel's argued verdicts on the open AI decisions leaders are weighing →
Editorial summary, takeaway, and curation by AIssential. Original article published by Bishop Fox - Bishopfox.com.