Confused deputy
A trusted, privileged component tricked into misusing its authority on behalf of a less-privileged attacker.
A classic security concept (named in 1988) that fits agents precisely. The agent holds real credentials and permissions. An attacker who cannot use those permissions directly instead persuades the agent — via prompt injection, a poisoned tool, a crafted request — to perform the privileged action for them. The agent is the confused deputy; its authority is the prize.
Why it matters
It explains why "the agent is authenticated and authorized" is not reassuring. The question is whether the agent can be induced to act against the user's interest while using that authorization. In OAuth-based MCP setups, confused-deputy problems also show up in how authorization codes and consent are handled between client, server, and upstream provider.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.