The confused deputy problem was named in 1988. It's the same bug. An agent with authority does what it's asked, by someone who shouldn't be asking. Prompt injection is a confused deputy attack wearing a hoodie. We know the fix. It's 40 years old.

Everyone's auditing the agent's reasoning. Nobody's auditing the 340 npm packages it pulled in to do the job. Any one of those can read your env vars. The model was fine. The dependency wasn't.

Your system prompt and the attacker's payload share one context window, both competing for the model's attention. You already know that fight goes badly some percentage of the time. Real enforcement has to live somewhere the model can't talk its way past.

Build revocation so you never need the agent to cooperate. Keep the revoke handle separate from the capability the agent carries. Something looks wrong, you pull it from the outside, and the agent learns about it by failing.

Tool poisoning works because the agent reads metadata humans never see, delivered with the same trust as everything else. Confinement breaks that assumption: untrusted code gets only the capabilities you grant it. A description field stops being an attack surface.

Prompt injection now drives most agentic AI failures in production. (Check out OWASP's "State of Agentic AI Security and Governance 2.01 ") You will not patch your way out of this. An agent that can be talked into misusing its authority needs less authority, not a better filter.

Capability systems compose differently. A capability you hold can be passed, narrowed, wrapped, or revoked, and the receiver gets exactly what you handed them, no more. The composition is the design, not a side effect.

"We have full audit logs" is the most reassuring sentence in agent infrastructure, and the most misleading. An audit log catches the second incident, not the first. It is a forensic tool, not a control.

The industry spent years trying to make LLMs ignore malicious instructions. Turns out the cheaper bet is making sure a compromised agent can't reach anything it wasn't handed. Least authority. References as permission. We've had this since the E language.

The Instagram hack was not just an AI chatbot failure. It was a confinement failure. AI agents should not hold broad standing authority over sensitive systems. They need explicit, scoped, revocable capabilities. Read DCF's latest post dcfoundation.io/the-instagra...

Stop trying to make the agent trustworthy. Make the authority you hand it small enough that you do not have to. That is the only design that survives a model swap, a vendor change, or a jailbreak.

The interesting question is not "can the agent explain what it did." It is "what was the agent capable of doing in the first place." Move the guardrail in front of the action. Logs are not a guardrail.

Every agent framework eventually rediscovers the confused deputy: a program with more authority than the user it acts for. The capability literature solved this in the 1980s. Agent infra is solving it again, from scratch, in production.

Ever loaded two copies of the same JS library into one realm & watched them refuse to recognize each other? There's a name for the way out now. We're calling it 'Spackle.' Read more about it in our latest blog post. tinyurl.com/4ndvn4ed

Endo

If you’ve shipped a JavaScript library that needs to be the same across every copy of itself in a realm, you’ve probably hit the wall this pattern is built for. Two instances of your module load.…

tinyurl.com

"Just give the agent your API key" is the password-reuse moment of the agent era. Full credentials handed to software that decides what to do with them at runtime. We have seen this movie.

Your audit log is a list of breaches you already paid for. For AI agents acting on your behalf, the control has to be at the point of action, not at the point of review. #aisafety #obejectcapabilitysecurity #OCapN

How does MetaMask let third-party Snaps run inside the wallet? Capability-based confinement on top of Endo. Snaps is one of two production users named on the Endo README, alongside Agoric. github.com/endojs/endo

GitHub - endojs/endo: Endo is a distributed secure JavaScript sandbox, based on SES

Endo is a distributed secure JavaScript sandbox, based on SES - endojs/endo

github.com

Where does HardenedJS sit in the JavaScript stack? Three primitives. Lockdown freezes the intrinsics. Harden freezes the transitively reachable object graph. Compartment runs untrusted code with only the authority you grant. That is the surface.

What is the difference between sandboxing and confinement? Sandboxing depends on a perimeter holding. Confinement is structural: after Lockdown, hardened references cannot be forged and authority is what you can name. Confinement is structural or it isn't confinement.

Why do denylists keep failing as the primary defense against supply-chain attacks? They depend on a list staying current and a rewrite never dropping the rule. Confinement does not. With Lockdown and Compartment, a dependency only gets the powers you hand it.

🧵 1/ The Grok-Bankrbot drain is a clean case study in why denylists fail as a primary defense. Bankrbot had a hardcoded block on Grok-originated replies. A maintenance rewrite dropped it. No regression test. ~$200K left a verified wallet.

What's the worst that can happen?

The web got safe b/c browsers became a collective bargain btween users & sites. A treaty, not a handshake. AI agents have no such treaty yet. @mnot.net just named the gap. Endo github.com/endojs/endo is the architecture he's describing. It exists. in production today www.mnot.net/blog/2026/04...

What's Missing in the ‘Agentic’ Story

Every online interaction is a lopsided negotiation. For AI to truly work for us, we need more than just safety -- we need to start building true agency as a form of collective bargaining.

mnot.net

🚨 Shipping AI agents? 🚨 Three questions: Prompt-injected, what can it reach? Exfiltrating data, what stops it? Dependency compromised, what's the blast radius? @kriskowal.com demos the Endo Familiar: dcfoundation.io/containing-a...

Every npm package you install gets full access to your entire machine. That's not a bug. It's the architecture. The axios attack just proved it again. This is precisely the sort of attack Endo and LavaMoat exist to make structurally impossible.

The Axios Attack Is Exactly What We’ve Been Warning About – Endo

Earlier this week, attackers published two poisoned versions of axios to npm. Versions 1.14.1 and 0.30.4 now inject a dependency called plain-crypto-js@4.2.1, a package that didn’t exist 24 hours…

endojs.org