🎯 Confused deputy attack

The items that name it 6

• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  article2026-09-17

  Cloud attack split by identity ownership (customer-managed vs provider-managed identities) in Kat Traxler's analysis

• The Agent Baseline: 35 Controls, But Where Should You Start?
  article2026-08-12

  A program holding legitimate authority gets tricked into exercising it on behalf of the wrong principal; concept originates from Norm Hardy, 1988. Cited as the key risk for shared internal agents (e.g., a prompt from Alice's data can end up exercising authority meant for Bob) when an agent uses a si

• One Request to Own Every Repo: How We Hijacked GitLab Through Its MCP Server - Pluto Security
  writeup2026-07-06

  SSRF causes the MCP server, holding a valuable credential, to attach that credential (Private-Token) to outbound requests directed at attacker-chosen hosts.

• AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
  writeup2026-06-19

  The browsing agent is 'carjacked' into acting on the attacker's behalf, using its localhost identity to reach a privileged local control plane

• The Masked Namespace Vulnerability In Temporal CVE-2025-14986 | depthfirst
  writeup2026-02-05

  The outer request passes authorization for AttackerNS while the inner startWorkflow payload names VictimNS, which the server uses to derive policies, aliases and schema during request preparation

• Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
  paper

  one of four adversary threat model categories for multi-agent LLM delegation