The Confused Deputy (or Why Capabilities Might Have Been Invented)¶
Hardy, N. (1988). The Confused Deputy (or Why Capabilities Might Have Been Invented): (or why capabilities might have been invented). ACM, 22(4), 36-38.
Cited by¶
16 citations across 16 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Access Control
This sourceOrigin of the confused-deputy problem, motivating capability-based authority.
- Confused Deputy
- When an action passes through an intermediary, its effective authority should be the intersection of the caller's authority and the intermediary's — the action is permitted only if both the originator and the executor were entitled to it.
This sourceOrigin of the confused-deputy concept (the compiler-billing example) and the capability-based remedy of carrying the originator's authority with the request.
- When an action passes through an intermediary, its effective authority should be the intersection of the caller's authority and the intermediary's — the action is permitted only if both the originator and the executor were entitled to it.
- Data-Control Plane Breach
- Naive analyses of injection attacks, social engineering, viral infection, and brood parasitism treat each as a substrate-specific failure — the parser was wrong, the user was gullible, the immune system was overwhelmed, the bird is foolish — and so miss what unifies them.
This sourceFoundational statement of the confused-deputy structure: a correctly-functioning program is induced to wield its own authority on behalf of a less-privileged caller because data (a file path) is acted on as control — the canonical data-as-control unification underlying injection-style breaches.
- Naive analyses of injection attacks, social engineering, viral infection, and brood parasitism treat each as a substrate-specific failure — the parser was wrong, the user was gullible, the immune system was overwhelmed, the bird is foolish — and so miss what unifies them.
- Indirection
- Information Use License
- The defect is invisible at every individual hop and visible only in the composite, which is why it surfaces late, in the hands of a party that did nothing wrong, and traces to no single bad decision.
This sourceShows authority composed across individually valid steps producing an action no principal intended to authorise, the defect being invisible at each step and visible only in the composite.
- The defect is invisible at every individual hop and visible only in the composite, which is why it surfaces late, in the hands of a party that did nothing wrong, and traces to no single bad decision.
- Untrusted Input Execution
- The transferred and non-obvious lesson is constant across substrates: a correctly-functioning interpreter is not a defense, so effort spent making the interpreter "smarter" about its inputs or harder to authenticate is misdirected, and the only durable fixes act on the boundary or the authority — which is why the capability-based fix proposed in 1988 reappears, structurally identical, as object capabilities, OAuth scopes done correctly, prepared-statement parameter binding, sealed content roles, and signed authority chains
This sourceIntroduces the confused-deputy problem and the capability-based fix that re-attaches the originator's authority so effective authority is the intersection, not the union — the 1988 fix that recurs structurally identical across substrates.
- The transferred and non-obvious lesson is constant across substrates: a correctly-functioning interpreter is not a defense, so effort spent making the interpreter "smarter" about its inputs or harder to authenticate is misdirected, and the only durable fixes act on the boundary or the authority — which is why the capability-based fix proposed in 1988 reappears, structurally identical, as object capabilities, OAuth scopes done correctly, prepared-statement parameter binding, sealed content roles, and signed authority chains
Domain-specific¶
- Cross-Site Scripting
- That mechanism genuinely recurs as co-instances across distinct interpreters — SQL injection (the database query parser), command injection (the shell), log injection, template injection, and prompt injection in LLMs (the model as interpreter) — and it shares a parent with the classical confused-deputy attack Hardy described, in which a program with no interpreter at all acts on a caller-supplied designation using authority of its own rather than the caller's
This sourceSupplies the confused-deputy limb this sentence closes on — a Tymshare compiler that 'serves two masters and carries some authority from each ... has no way to keep them apart', acting on a caller-supplied designation with authority of its own and no interpreter anywhere in the picture — but not the injection co-instances listed alongside it.
Supported in partVerified against the source
- That mechanism genuinely recurs as co-instances across distinct interpreters — SQL injection (the database query parser), command injection (the shell), log injection, template injection, and prompt injection in LLMs (the model as interpreter) — and it shares a parent with the classical confused-deputy attack Hardy described, in which a program with no interpreter at all acts on a caller-supplied designation using authority of its own rather than the caller's
Mechanisms¶
- Access Control List
- The classic misuse is the confused deputy
This sourceShows how an ACL-protected compiler can be induced by its caller to exercise the compiler’s own authority against a protected file.
- The classic misuse is the confused deputy
- Authentication Broker
- And a broker that acts on ambient authority can be turned into a confused deputy
This sourceShows how a caller can exploit a privileged program's ambient authority, inducing it to exercise that authority for a purpose the caller could not authorize directly.
- And a broker that acts on ambient authority can be turned into a confused deputy
- Capability Object
- Its strength is that it kills a whole class of ambient-authority bugs by construction: a unit literally cannot exceed the powers in its hand, which is the cleanest defense against the confused deputy — a component tricked into misusing authority it holds ambiently on someone else's behalf.
This sourceExplains the confused deputy as a component tricked into using authority from the wrong principal and shows how explicit capabilities bind designation to the authority actually supplied.
- Its strength is that it kills a whole class of ambient-authority bugs by construction: a unit literally cannot exceed the powers in its hand, which is the cleanest defense against the confused deputy — a component tricked into misusing authority it holds ambiently on someone else's behalf.
- Capability-Scoped Tool Gateway
- … is that a gateway is only as strong as its scoping: an over-broad grant — "give the agent write access to the whole database, we'll trust the prompt" — turns the gateway into a rubber stamp, and the classic confused-deputy trap is exactly a privileged component induced to misuse authority it legitimately holds.
This sourceShows how a compiler holding legitimate file authority can be induced by a user to overwrite a protected billing file.
- … is that a gateway is only as strong as its scoping: an over-broad grant — "give the agent write access to the whole database, we'll trust the prompt" — turns the gateway into a rubber stamp, and the classic confused-deputy trap is exactly a privileged component induced to misuse authority it legitimately holds.
- Capability-Scoped Tool Invocation
- Its strength is that it targets the structural vulnerability — a deputy acting with borrowed authority on attacker-influenced input — rather than trying to detect the malicious input itself, which is exactly the confused-deputy failure that content inspection keeps missing.
This sourceDefines the confused-deputy problem as a deputy exercising authority on attacker-influenced requests.
- Its strength is that it targets the structural vulnerability — a deputy acting with borrowed authority on attacker-influenced input — rather than trying to detect the malicious input itself, which is exactly the confused-deputy failure that content inspection keeps missing.
- Confused-Deputy Abuse-Case Test
- The name points at the classic failure it hunts: the deputy that is not compromised, just confused about whose will it is serving.
This sourceShows an uncompromised deputy misapplying authority because it cannot distinguish which principal’s authority governs a request.
- The name points at the classic failure it hunts: the deputy that is not compromised, just confused about whose will it is serving.
- Reverse Proxy Server
- Its dangerous failure mode is the confused deputy: because the proxy holds privileged reach into the private network, an attacker who tricks it into forwarding a crafted request can make it act as their agent against the very backend it protects (request smuggling and server-side request forgery are this pattern).
This sourceDescribes a confused-deputy failure in which an attacker tricks a privileged proxy into forwarding a crafted request.
- Its dangerous failure mode is the confused deputy: because the proxy holds privileged reach into the private network, an attacker who tricks it into forwarding a crafted request can make it act as their agent against the very backend it protects (request smuggling and server-side request forgery are this pattern).
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 1 of 16 citations: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Was it audited? Yes. A second, independent pass read the citation against the article text and recorded a verdict.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:5f5a3412bb12 · see in the full table