Confused deputy
A classic security problem, dated 1988, that agents reproduce almost perfectly: a privileged component is tricked by a less-privileged party into misusing its authority. The agent holds the user's tokens, repository access and shell; an attacker who cannot reach any of those directly only has to get an instruction in front of the agent. Nothing is "hacked" — the deputy does exactly what it was asked, on behalf of the wrong principal. Framing agent security this way explains why authenticating the user does not help.
See also indirect prompt injection · lethal trifecta · action layer
Documented incident — third-party registry ai-escape.watch ↗ (not ours): "Prompt injection through a coding-agent CI action as a build-pipeline foothold", evidence tier B — the agent holds the pipeline credentials, so a party who can only file an issue obtains a build-system compromise.
Related terms
-
Indirect prompt injection
Attack concepts
The instructions are planted in content the agent reads rather than text the user types — a web page, a GitHub issue, a code comment, a dependency's…
-
Lethal trifecta
Attack concepts
Simon Willison's name for the combination that turns an agent into an exfiltration engine: (1) access to private data, (2) exposure to untrusted content…
-
Action layer
Agents & architecture
The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it.
Attack concepts
The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.