---
title: Confused Deputy Attacks
url: https://www.emergentmind.com/topics/confused-deputy-attacks-cdas
type: topic
---

# Confused Deputy Attacks

Confused deputy attacks (CDAs) are security failures in which an attacker induces a privileged or trusted component—the deputy—to perform an action on the attacker’s behalf that the attacker is not directly authorized to perform. The deputy’s authority may arise from kernel mediation, address translation, DMA-capable acceleration, contract callbacks, browser or GUI automation, retrieval pipelines, or tool-execution runtimes; the common failure is that the system applies authority on the basis of attacker-influenced designation, metadata, or context rather than a correctly bound authorization decision. Recent work shows that this pattern recurs across hardware fault attacks, accelerators, smart contracts, mobile autofill, RAG systems, agent frameworks, computer-using agents, ChatGPT Apps, and agentic browsers [2007.08707][2605.17707][2407.01204][2104.10017][2408.04870][2606.28679][2603.14707][2606.00485][2605.05509].

## 1. Definition and conceptual anatomy

In the classical formulation used across these papers, a CDA occurs when an attacker cannot directly access a protected resource but can cause a legitimate authority to do it implicitly. The attacker supplies designation or influence; the deputy supplies authority; the victim is the protected resource or security boundary that should not have been crossed. PThammer states this pattern directly: the attacker does not directly read or write protected memory, but instead coaxes the processor and memory-management machinery into performing the harmful access indirectly [2007.08707].

A recurring analytical decomposition is attacker, deputy, and victim. In PThammer, the attacker is an unprivileged user-space process, the deputy is the processor’s address translation logic, and the victim is protected page-table memory such as L1PTE addresses. In the Edge AIA setting, the attacker is a userspace application, the deputy is the AIA, and the victim is restricted host memory. In ChatGPT Apps, the malicious app cannot directly invoke the victim app, but can induce the LLM mediator to do so through the shared context. In LLM agent frameworks, the attacker controls content rather than code, while the runtime executes model-emitted tool calls with real authority [2007.08707][2605.17707][2606.00485][2606.28679].

These works also converge on a distinction between authorization and mere designation. The LLM-agent paper states that capability gating is static exposure control, whereas per-call authorization is dynamic, value-sensitive control, and that **“Tool exists” is not the same as “this specific invocation is authorized.”** The same structural distinction appears in hardware and accelerator settings: an identifier, pointer, mask, source lane, callback, or context entry may be syntactically valid, range-valid, or schema-valid while still denoting the wrong authority basis [2606.28679][2606.11878][2407.01204].

This suggests a general characterization: CDAs arise when a privileged component accepts attacker-influenced designation without re-binding it to an independently derived authorization context. Different papers name that failure as a semantic gap, implicit endorsement, stale authority, participation-authority misbinding, or conflation of control and data, but the security structure is the same [2605.17707][2407.01204][2606.11878][2408.04870].

## 2. Hardware, accelerators, and non-control-data deputies

Several recent papers show that CDAs are not confined to classical software services. They also arise when hardware or microarchitectural components perform privileged accesses on behalf of unprivileged requests.

| Setting | Deputy | Authority failure |
|---|---|---|
| PThammer | address translation logic | implicit frequent accesses to protected page-table memory |
| Edge AIA CDA | AI accelerator | unvalidated SMIDs reach restricted host memory |
| CUDA CSC | collective primitive | wrong membership, contribution, role, or epoch is authorized |

PThammer is an eviction-based cache and TLB attack in which attacker-controlled user-space access patterns force repeated address translation and memory references. The paper summarizes the mechanism as  
$$
\text{user access} \Rightarrow \text{TLB/cache eviction} \Rightarrow \text{page-table walk / memory access} \Rightarrow \text{DRAM row activations}
$$  
and emphasizes that the attack needs **“not only implicit but also frequent DRAM accesses to target addresses.”** The novelty is therefore not only Rowhammer disturbance, but the use of privileged translation machinery as the confused deputy that reaches protected page-table memory and enables cross-user-kernel compromise [2007.08707].

The Edge AIA study makes the memory-CDA conditions explicit: **1. AIA fails to validate SMIDs** and **2. Attacker can provide SMIDs to restricted memory regions**. Because AIAs are optimized for performance, use zero-copy transfers, and have limited OS-level awareness, the accelerator may receive a Shared Memory Identifier without understanding whether it denotes attacker-owned user memory, another process’s memory, or kernel memory. The paper reports that CDA is feasible on **6 of the 7 evaluated AIAs**, impacting **over 128 SoCs** and **over 100 million devices**, and proposes an **On-Demand Validation** defense whose evaluation on **GEM5-SALAM** reports **15.33% average overhead**; strict per-transaction IOMMU enforcement is reported as roughly **56% to 623%** depending on settings and benchmarks [2605.17707].

The CUDA paper generalizes the CDA lens further by treating collective primitives as deputies and participation metadata as the authority token. It defines Collective Semantic Corruption (CSC) as the case where a CUDA-conforming collective authorizes a decision over the wrong authority set because masks, predicates, source lanes, descriptors, group labels, or epochs are corrupted. The site-local participation-authority contract is written as  
$$
C_\ell=(I_\ell,M_\ell,P_\ell,R_\ell,\Phi_\ell)
$$  
and a CSC instance satisfies  
$$
\mathsf{CUDAConforming}(\ell) \wedge \mathsf{RangeValid}(O_\ell)\ \wedge\ \mathsf{SecObs}(c(O_\ell)) \ne \mathsf{SecObs}(c(C_\ell)).
$$  
The core result is a **trusted-reference mismatch in 102/102 instances**, while hardened variants preserve that reference in **102/102 instances**; **13 synchronization-sensitive instances** are reported separately [2606.11878].

A common lesson across these systems is that low-level validity checks are insufficient. A mask can be legal, an SMID can be well-formed, and a microarchitectural access path can be architecturally legitimate, yet the deputy can still act on the wrong authority basis [2605.17707][2606.11878][2007.08707].

## 3. Callbacks, credential mediation, and contract-level authority

Smart contracts provide a particularly clear formulation of CDA as implicit endorsement. The SCIF paper characterizes CDAs as integrity violations in which an attacker influences a trusted action without explicit endorsement, typically through callbacks or indirect invocations. Its central observation is that the deputy’s call to an attacker-chosen target implicitly endorses that target selection, while the callee may interpret the call as conveying stronger authority than the caller intended. To prevent this, SCIF combines IFC with explicit `endorse`, dynamic trust checks on public entry points, and runtime method-signature checks that include labels rather than only method names and base types. This full-signature dispatch is the paper’s main defense against callback type confusion in examples such as Dexible and Poly Network [2407.01204].

The mobile autofill study shows the same pattern in user-facing credential mediation. Here the deputy is the autofill framework: it presents the autofill UI, decides when credentials may be offered and inserted, and mediates access between password manager, app or browser, and webpage. The paper formulates three required properties:  
$$
\textbf{P1: User authorization}
$$  
$$
\textbf{P2: Secure credential-to-destination mapping}
$$  
$$
\textbf{P3: Filled credentials must only be accessible to the mapped destination}
$$  
and argues that mobile autofill frameworks can become confused deputies in manager-assisted credential phishing attacks when they offer or insert credentials in malicious webpages or hostile WebViews [2104.10017].

The attack flows are structurally classical. A benign app hosts a WebView; malicious or compromised content renders a login form; the framework sees a login prompt and presents trusted autofill UI; the user interprets that UI as evidence of safety; the credentials are filled and become visible to malicious page code or injected JavaScript. The paper concludes that while mobile frameworks improve user interaction security, they often undermine destination binding and post-fill confidentiality, and may even make mobile password managers less secure than desktop counterparts overall, especially in browsers and WebViews [2104.10017].

These contract and autofill examples show that a CDA does not require code execution in the protected component. The deputy may simply dispatch a callback or present a fill suggestion under incorrect authority assumptions. The security failure lies in what the deputy implicitly vouches for [2407.01204][2104.10017].

## 4. Tool-using LLM agents and runtime authorization

In LLM agent systems, the deputy is typically the runtime that holds side-effecting tools while reading untrusted content. The audited-framework paper states the core failure succinctly: LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit provide capability gating by default, but none provides a deterministic fail-closed per-call value authorization gate by default. The default failure mode is that a model-emitted tool call is dispatched after tool-name lookup and shape or schema validation, but concrete argument values are not re-authorized before execution. The paper’s reference control, **ScopeGate**, introduces five stages—scope, authorization, money ceiling, idempotency, and default deny—and reports **0/48 static bypasses**, **0/29 unauthorized attempts (40-iteration adaptive run)**, **0/10 benign false-denies**, and **Latam-GPT payment-agent containment at 10/10** [2606.28679].

The AARM specification broadens this into a runtime-security architecture. It treats the orchestration layer as untrusted, shifts the security boundary to tool execution, and requires that all actions be intercepted before execution. Its central mechanism is accumulated session context,  
$$
\mathcal{C}_n = \mathcal{C}_{n-1} \cup \{a_n, o_n, \delta_n\},
$$  
combined with policy evaluation over the action-context pair,  
$$
\pi: (a, \mathcal{C}) \rightarrow \{ALLOW, DENY, MODIFY, STEP\_UP, DEFER\}.
$$  
The paper explicitly presents confused deputy attacks as cases in which static authorization might permit an action, but the intent is adversarial; intent alignment, context-dependent deny, defer, and step-up are therefore the primary anti-CDA mechanisms [2602.09433].

SEAgent instantiates a related idea in LLM-based agent systems using a MAC framework built upon ABAC and an information-flow graph. It defines privilege escalation formally as the existence of an invocation action outside the oracle-defined minimal action set for the user query, and extends that model to inter-agent messaging. Its multi-agent confused deputy case study uses a malicious web browser or search agent to cause a trusted smart lock agent to invoke `UnlockDoor`. The enforcement logic is path-sensitive: an upstream `UNFILTERED` agent influencing a non-`LOW` sensitivity tool is denied, even if a trusted intermediary agent is the immediate caller. The paper reports **0% ASR** for SEAgent on the benchmarked attack categories and negligible policy-check overhead in the AWS benchmark, with average policy-check time **0.00586s** in travel and **0.00307s** in mortgage [2601.11893].

Across these agent papers, the central doctrine is that the model may propose, but only an independent policy mechanism may approve. Capability exposure, schema conformance, and delegated credentials do not by themselves constitute authorization [2606.28679][2602.09433][2601.11893].

## 5. Perception, shared context, and web-mediated confused deputies

Recent AI papers extend the CDA concept beyond symbolic tool invocation into perception, context sharing, and ordinary web interaction. The visual confused deputy paper defines a failure mode in which a computer-using agent authorizes an action based on a misperceived screen state caused by grounding errors, adversarial screenshot manipulation, or TOCTOU races. The concrete **ScreenSwap** attack swaps the pixel regions of two GUI buttons in the screenshot so that the LLM believes it is clicking a benign control while the real coordinates hit a privileged control. To mitigate this, the paper proposes **dual-channel contrastive classification**, operating outside the agent’s perceptual loop, with an OR/veto rule that blocks if either the visual click-target channel or the textual reasoning channel indicates risk. Reported results include **F1 = 0.875** on **13 OS-Harm scenarios**, **F1 = 0.915** for image + text veto on **260 real screenshots and 1040 test cases** from ScreenSpot-Pro, and runtime of about **14 ms per click** on an AMD MI300X GPU [2603.14707].

The agentic-browser paper argues that indirect prompt injection is only part of the problem. It frames the browser agent as a confused deputy that cannot distinguish legitimate page components from malicious ones and derives a taxonomy of **20 attacks**, implementing **18** and reproducing **14 of the 20 attacks** across **4 major LLM models**. Its five failure modes include agents bridging same-site data, bridging cross-site data, hallucinating URLs, websites attacking the LLM itself, and agents misusing integrated tools. A key claim is that agentic browsers collapse trusted and untrusted page content into a single input, allowing traditional web threats such as phishing, scams, and interface mimicry to reemerge in amplified form [2605.05509].

The ChatGPT Apps paper identifies **cross-app context poisoning** as a CDA in a multi-tenant LLM platform. Multiple third-party apps share one conversation and write into a persistent, flat, untagged context visible to the LLM and to co-resident apps. The paper emphasizes `sendFollowUpMessage` as the direct write primitive and reports that undocumented parameters `systemPrompt` and `isVisible` amplify it to silent, system-priority writes. Using this channel, a malicious app can poison context so that the LLM later manipulates benign co-resident apps; the base confused-deputy attack succeeds across six evaluated ChatGPT models, and the paper argues that fixing the problem requires an architectural change rather than a patch [2606.00485].

ConfusedPilot shows the same structural problem in enterprise RAG. Retrieved document text and task instructions are concatenated into a single modified prompt, so an attacker who can modify shared documents can cause the deputy to treat malicious text as instruction rather than evidence. The paper presents two principal effects: integrity compromise through malicious text in modified retrieval prompts and confidentiality compromise through stale cache or phantom documents. It further argues that misinformation can propagate across enterprise workflows when victims reuse Copilot outputs in downstream documents, turning the deputy into a misinformation multiplier [2408.04870].

A plausible implication is that modern CDA surfaces increasingly involve not only explicit delegation, but also mediated perception and mediated context. The deputy may be confused by pixels, retrieved prose, or shared conversational state just as readily as by a pathname, callback, or memory identifier [2603.14707][2606.00485][2408.04870][2605.05509].

## 6. Defensive principles, recurring misconceptions, and open directions

Across these domains, defenses converge on authority binding rather than mere input validation. **On-Demand Validation** for AI accelerators revalidates SMIDs against PID-scoped kernel knowledge and defers unmapping to block stale mappings; **Collective Integrity Contracts (CIC)** bind participation metadata before collective use; **SCIF** requires explicit endorsement and full-signature agreement for callbacks; **ScopeGate** inserts a deterministic PDP/PEP between the model and the side-effecting tool; **AARM** intercepts every action at runtime and evaluates it against accumulated context and intent alignment; the visual guardrail verifies both what the agent is clicking and why; the ChatGPT Apps paper calls for per-app context isolation, context provenance, cross-app permissioning, and return-path mediation [2605.17707][2606.11878][2407.01204][2606.28679][2602.09433][2603.14707][2606.00485].

Several misconceptions are rejected repeatedly. First, range-validity, schema-validity, or type-shape validity is not enough: a valid mask, source lane, SMID, or tool argument may still encode the wrong authority [2606.11878][2605.17707][2606.28679]. Second, capability gating is not authorization; exposure of a tool or primitive does not authorize a specific call with attacker-chosen concrete values [2606.28679]. Third, prompt-injection framing alone is too narrow: agentic browsers are vulnerable to ordinary web deception, and visual confused deputies arise from misperceived state even without textual injection [2605.05509][2603.14707]. Fourth, software-only defenses are not universal: PThammer shows that detection focused on cache miss rates or same-row access patterns can miss translation-driven access patterns, while several accelerator and platform papers argue that architectural changes are sometimes required [2007.08707][2605.17707][2606.00485].

The literature also separates containment from cure. The ScopeGate paper explicitly states that containment is not a cure: it bounds what a compromised model can do via governed tools, but does not stop prompt injection itself, detect poisoned weights, or guarantee safe natural-language output [2606.28679]. Similar limitations appear elsewhere: the ChatGPT Apps paper treats flat shared context as an architectural gap by design; the RAG paper notes the difficulty of separating instructions from retrieved content because legitimate documents may themselves contain instruction-like language; the mobile autofill paper shows that secure UI signaling can itself become part of the deputy problem when the framework’s trust cues are misapplied [2606.00485][2408.04870][2104.10017].

The broader technical lesson is that CDAs are best understood as authorization failures caused by misbound authority. Whether the deputy is a page-table walker, an AIA, a collective primitive, an autofill framework, a smart contract, a browser agent, a computer-using agent, a RAG pipeline, or an LLM tool runtime, the decisive question is the same: who or what is the deputy actually authorized to act for at the moment of use? Systems that do not answer that question with independent, fail-closed mediation remain vulnerable to confused-deputy failure.

Source: https://www.emergentmind.com/topics/confused-deputy-attacks-cdas