PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Otto Support - The Confused Deputy

bishopfox.com | blog | #ai-security | #agentic-ai | #mcp | #prompt-injection | #ai-agents | #copilot | #mitigations | #confused-deputy
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Confused deputy attacks: agents reading attacker-controlled tickets or invites follow hidden instructions with their own privileges, as EchoLeak and ConfusedPilot show; layered mitigations covered.
Published
Collected

Related coverage

tool · github.com
SpecterOps Skills: Open-Source LLM Agent Skills & MCP Plugin Marketplace for Red Teaming and AppSec
As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.
blog · about.gitlab.com
New MCP tools help platform teams scale automation safely
GitLab 19.4 expands the GitLab MCP server tool set so agents can run pipelines, open merge requests, and triage vulnerabilities, while writes, merges, and deletes still wait for a human reviewer.
blog · bugcrowd.com
What’s changed in AI security over the past two years
Bugcrowd compares its 2024 and 2026 AI security guides: 80% of Fortune 500 run autonomous agents, making memory poisoning and plan hijacking real attack classes — plus regulation and 'AI slop'.
blog · wiz.io
Growing the WIN AI Ecosystem with Agent Integrations
Wiz MCP agent integrations now let partner AI agents pull live Wiz context—Issues, findings, attack paths—on demand from customer tenants, with the WIN partners endpoint GA for building integrations.
blog · crowdstrike.com
Agents of Chaos: A New $100K Agentic Security Challenge
CrowdStrike launched Agents of Chaos, a $100,000 online game and AI red teaming competition in which players manipulate real AI agents using prompt injection and other adversarial techniques.
blog · netspi.com
How App Integration Transactions Increase the Attack Surface of LLMs
Learn how OpenAI's AppsSDK, AgentKit, and "Buy It" turn LLMs into transactional agents—expanding security risks from rapid rollout, prompt injection, and access control gaps.
Back