Around 1977, a Fortran compiler at Tymshare overwrote the company's billing file. Nobody was malicious. A user named that file as the destination for debugging output, and the compiler obliged. It had directory write access for logging statistics, and it carried the user's authority to write wherever specified. Two legitimate purposes flowing through a single pool of permissions, with nothing in the system's design to distinguish them.
Norm Hardy, who was there, wrote it up a decade later. The code was correct when written, he observed. It became a flaw only when the system granted the compiler additional authority for a separate purpose. Permissions attached to the compiler's identity, to what it was, rather than to the task it was performing. Hardy called it the confused deputy.
His colleagues tried patching: a system call to switch between authorities. It handled two principals, then more appeared. The file-opening rules grew to fourteen boolean operators. Each clause that enabled a legitimate action opened a path for an illegitimate one.
An AI agent inherits exactly this structure. It carries tokens from its deployer, its user, and integrated services. It reads documents and web pages that may contain instructions, processed with that same undifferentiated authority. Microsoft was assigned a CVE for this pattern in Copilot Studio in April 2026. The specific vulnerability was patched. But the confused deputy isn't a vulnerability. It's a consequence of how identity-based access control works when software acts on behalf of others, which is what agents do by definition.
The structural match
| 1977 compiler | 2026 agent |
|---|---|
| Directory write access | OAuth tokens, API keys, tool registrations |
| User-supplied filename | Untrusted content in emails, docs, web pages |
| Billing file overwritten | Unintended queries, exfiltration, API calls |
| "No way of expressing these intents" | Cannot distinguish whose purpose a request serves |
Key dates
- ~1977: Compiler overwrites billing file at Tymshare
- 1988: Hardy publishes "The Confused Deputy" — three pages, [353 citations](https://www.semanticscholar.org/paper/The-Confused-Deputy:-(or-why-capabilities-might-Hardy/5493f512ba418c21f1ce20e20985157f7509007c) to date
- Dec 2025: OWASP Top 10 for Agentic Applications formalizes the pattern as "Agent Goal Hijack"
- Apr 2026: Microsoft assigned CVE-2026-21520 for a confused deputy path in Copilot Studio
When is an agent exploitable? Simon Willison's test: when it has access to private data, exposure to untrusted content, and the ability to act externally. Most production agents qualify.