PIP-018
Confused deputy escalation
The model is used as a proxy to exercise privileges the attacker does not hold, because the system acts on its own authority rather than the requester's.
How it works
An assistant typically runs with a service identity broader than any individual user. If it can be induced to perform an action, it performs it with that identity, so the attacker inherits reach they never had. This is the classic confused deputy problem, restated for systems that take instructions in natural language.
Why it works
Authorisation is checked when the system connects to a resource, not when it decides to. The decision is made from context an attacker can influence; the credential is applied afterwards regardless.
What it looks like
A request, arriving through any injection vector, for an operation the assistant is capable of and the requester is not entitled to.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Act with the requester's authority, not the system's
Architectural
Propagate the user's identity to downstream calls so the assistant cannot exceed what the person on whose behalf it acts could do directly. This eliminates the escalation rather than mitigating it.
Separate reading from acting
Architectural
Split components that consume untrusted content from components that hold privileges, so the part that can be influenced is not the part that can act.
Assess blast radius per system
Raises cost
For each assistant, establish what it holds and what the worst realistic outcome is if it is misled today. Most organisations cannot answer that, and the inability is itself the finding.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- LLM06:2025 · OWASP LLM Top 10
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.