Applied AI·Security and safety
the agent held the credentials and someone else supplied the instructions, so your own privileged component did the attacker's work for them.
Confused deputy
Draft summary, pending review
The classic pattern where a privileged component is tricked into misusing its authority on an attacker's behalf; an injected agent with tools is exactly this. The mitigations are the classic ones too: least privilege, scoped credentials, confirmations for sensitive actions.