Otto Support - The Confused Deputy

Bishop Fox's otto-support CTF demonstrates confused deputy attacks against AI agents, where an agent reads attacker-controlled content (a poisoned support ticket, email, or calendar invite) and executes hidden instructions using its own legitimate privileges. The write-up reproduces the scenario via IDOR-based ticket poisoning and metadata service abuse to escalate into a support-agent role, referencing real-world cases like EchoLeak, ConfusedPilot, and Copilot calendar exploits, and proposes mitigations such as data/instruction separation, per-task tool registration, least privilege, human-in-the-loop, and egress controls.