Research
Otto Support - The Confused Deputy
Publication date not yet evaluated · Added daily.dev
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
Confused deputy attacks let an AI agent's own legitimate privileges be turned against the enterprise, producing exfiltration and destructive actions that appear authorized under the user's identity in audit logs.
Bishop Fox's otto-support CTF demonstrates confused deputy attacks against AI agents, where an agent reads attacker-controlled content (a poisoned support ticket, email, or calendar invite) and executes hidden instructions using its own legitimate privileges. The write-up reproduces the scenario via IDOR-based ticket poisoning and metadata service abuse to escalate into a support-agent role, referencing real-world cases like EchoLeak, ConfusedPilot, and Copilot calendar exploits, and proposes mitigations such as data/instruction separation, per-task tool registration, least privilege, human-in-the-loop, and egress controls.