Skip to content
1Claw Academy
Curriculum/The AI Agent Threat Model2 minBeginner · Lesson 9 of 14

Excessive agency and the confused deputy

Understand why an agent's privileges, not its intentions, determine how bad an attack gets.

A confused deputy is a program with legitimate privileges that is tricked into using them on someone else's behalf. The classic case is decades old. An agent is an unusually effective confused deputy, because being steered by text is its normal operating mode.

The attacker does not need to escalate privilege. They borrow the agent's.

Tip

This reframes the question. It is not 'can an attacker compromise the agent'. It is 'what can the agent do, on its worst day, having been convinced it should'. The answer is a property of your authorization design, not of the model.

Work the three root causes in order, because they compose:

  • Excessive functionality: an agent that summarises documents does not need a delete tool. Remove it and a whole branch of attacks disappears.
  • Excessive permissions: if it needs to read one path, its credential should not reach the others. Scope the grant, not just the tool.
  • Excessive autonomy: some actions should not be one model decision away from happening, regardless of how confident it seems.

Human-in-the-loop is the control for the third, and it works best when it is graduated rather than binary. Refusing everything risky makes the agent useless, and people route around useless controls.

  • Below a threshold, proceed and log.
  • Above it, hold and ask a human, with enough context for a real decision.
  • Above a higher bar, require step-up authentication: a passkey or a second factor, not just a click.
  • For a narrow set of actions, refuse outright and do not offer an override.
Watch out

An approval prompt that appears constantly gets approved reflexively. Tiering exists so the prompts that do appear carry real information; that is a security property, not just a usability nicety.

Check your understanding

3 questions
1

What makes an agent a natural confused deputy?

2

Why is graduated approval better than approving every risky action?

3

An agent is tricked into deleting records it had permission to delete. Which root cause is primarily at fault?