The confused deputy problem occurs when a privileged component is induced to use its own authority on behalf of a less privileged requester — in AI, when an agent or connector holding broad credentials retrieves or acts on data the requesting user was never entitled to.
What is the confused deputy problem in AI systems?
This is the classic security failure that AI architectures reproduce almost by default. An integration or agent is provisioned with a broad service account so that it can serve many users, and then serves each of them with that broad authority rather than their own. Nothing is technically compromised, and the access log records only the service account, which is why the problem so often survives review. The remedy is identity propagation: the agent acts under the requester's entitlements, delegation is explicit and bounded, and the originating identity is preserved through every hop.