---
title: "Otto Support - The Confused Deputy"
url: https://daily.dev/posts/otto-support---the-confused-deputy-d4xmzthp7
source_url: https://bishopfox.com/blog/otto-support-confused-deputy
type: article
source: "Sliver C2 Documentation"
published: 2026-08-23T12:22:41.513Z
updated: 2026-08-23T12:49:42.654Z
tags: ["ai-agents", "mcp", "prompt-injection", "microsoft-copilot"]
reading_time: 5
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Otto Support - The Confused Deputy

**[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 5 min read · 0 upvotes · 0 comments

## Summary

Confused deputy attacks occur when an AI agent reads attacker-controlled content, such as a poisoned support ticket, email, or calendar invite, and follows hidden instructions using its own legitimate privileges rather than the attacker's. Real-world cases including EchoLeak, ConfusedPilot, and Copilot calendar exploits illustrate this at enterprise scale. Bishop Fox's otto-support CTF reproduces the scenario via IDOR-based ticket poisoning and metadata service abuse to escalate into a support-agent role. Mitigations include separating data from instructions, per-task tool registration with least privilege, human-in-the-loop for destructive actions, and network egress controls.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://bishopfox.com/blog/otto-support-confused-deputy>

## Questions this post answers

### What is a confused deputy attack in the context of AI agents?

A confused deputy attack happens when an AI agent with tool access reads attacker-controlled content, such as a poisoned support ticket, email, or calendar invite, and executes the hidden instructions using its own legitimate privileges rather than the attacker's. The result is that the agent's actions appear authorized and show up under the user's own identity in audit logs, even though an attacker triggered them.

_Teams securing agentic AI workflows can follow emerging confused-deputy research and mitigations on daily.dev._

### What mitigations reduce the risk of confused deputy attacks in AI agent systems?

Layered defenses work best: separating data from instructions using prompting and markup, restricting agents to per-task tool registrations instead of granting all tools to one agent, enforcing least privilege so read-only tools lack destructive write capability without human approval, and adding network egress controls that only permit approved destinations so exfiltrated data cannot leave the environment.

_Engineers designing agent permission models can track practical mitigation patterns like these on daily.dev._

### What real-world incidents demonstrate confused deputy attacks against Microsoft Copilot?

EchoLeak (disclosed around June 2025) let a crafted email trick Microsoft 365 Copilot into using its own enterprise access to retrieve and exfiltrate confidential data without direct attacker access to underlying resources. A separate incident named ConfusedPilot (August 2024) had an agent monitoring a distribution list leak confidential data back to an attacker via email after processing a malicious prompt.

_Developers evaluating Copilot-style agent risk can follow incident writeups like these on daily.dev._

---

Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#microsoft-copilot](https://daily.dev/tags/microsoft-copilot)

[View this post on daily.dev](https://daily.dev/posts/otto-support---the-confused-deputy-d4xmzthp7)