🎯 Confused deputy

The items that name it 24

• AI Models Raise Their Own Circle Wallet Spending Caps
  articleas classification.key entities2026-10-27
• Nicholas Martin (@ndgmlondon) on X
  threadas classification.key entities2026-10-27
• My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
  paperas classification.key entities2026-10-15
• Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization
  paperas classification.key entities2026-10-15
• Phillip Shoemaker (@pbsIdentity) on X
  threadas classification.key entities2026-10-12
• My personal AI agent posted my bank details on company Slack
  articleas classification.key entities2026-10-10
• lee1981 (@lee1981b) on X
  advisoryas classification.key entities2026-10-09
• Chrome 155 Update Patches 247 Vulnerabilities
  articleas classification.key entities2026-10-07
• Sandboxes Explained: What Each Type Actually Isolates | Blog | Endor Labs
  articleas classification.key entities2026-10-02
• Binary Security: Azure Logic Apps cross-tenant compromises (One Root Case)
  writeupas classification.key entities2026-10-02
• AI Agent Sandbox Flaw in brig: Symlink Traversal (CVSS 8.2) | Blog | Endor Labs
  writeupas techniques2026-09-28

  brig acts as a confused deputy: it resolves the path only to check it doesn't point to filesystem root, then discards the resolution and passes the unresolved path-as-typed to the runtime, which resolves and mounts it independently on the host.

• How we found 24 Android vulnerabilities using our open source AI security agent
  writeupas classification.key entities2026-09-28
• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  articleas classification.key entities2026-09-17
• Top MCP Security Resources — September 2026 (Adversa.ai)
  articleas techniques2026-09-07

  Azure DevOps confused deputy bug, referenced as covered in last month's digest.

• The Agent Baseline: 35 Controls, But Where Should You Start?
  articleas classification.key entities2026-08-12
• Top MCP security resources — August 2026
  articleas classification.key entities2026-08-06
• When Your AI Reviewer Works for the Attacker: A Confused-Deputy Bug in Microsoft
  writeupas techniques2026-07-21

  Victim's AI agent, holding the victim's credentials, is hijacked by hidden instructions and performs actions across projects the attacker could not access directly

• Solving GitHub's Secure Code game with an AI red teaming agent
  writeupas classification.key entities2026-07-17
• Vulnerability-Lookup
  advisoryas techniques2026-06-18It is written here as Confused-deputy.

  Unauthenticated MCP caller invokes tools like read_query, and the server executes the request using its own privileged server-side Pinot credentials (PINOT_TOKEN or PINOT_USERNAME/PINOT_PASSWORD), laundering the caller's lack of identity into the server's privileges against the upstream Pinot cluste

• Careful Adoption of Agentic AI Services
  advisoryas classification.key entities2026-05-13
• CAREFUL ADOPTION OF AGENTIC AI SERVICES FINAL
  advisoryas classification.key entities2026-05-06
• The Masked Namespace Vulnerability In Temporal CVE-2025-14986 | depthfirst
  writeupas classification.key entities2026-02-05
• Disclosure of 7 Android and Google Pixel Vulnerabilities | Oversecured Blog
  writeupas classification.key entities
• Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
  paperas classification.key entities