The Orchestrator's Deputy Has No Scope: Ambient Authority Is the Root Bug in Multi-Agent AI

The Core Problem: Ambient Authority and the Confused Deputy

CVE-2025-53773, CVSS 7.8: a prompt injection causes GitHub Copilot to rewrite .vscode/settings.json and execute arbitrary commands on the developer's machine. The agent had the authority. Nothing constrained it to its declared task. That is ambient authority. That is the confused deputy problem. Language models are structurally unfit to be authorization decision points.

The confused deputy problem in AI agents is not a prompt injection problem: it is a structural misplacement of the authorization decision inside the model. Every delegation from orchestrator to sub-agent expands the attack surface. The sub-agent inherits the full context envelope, not a scoped subset.

Capability Gating Is Not Authorization

LangChain, LangGraph, LlamaIndex, and Stripe Agent Toolkit all treat capability gating as the security boundary. The agent can only call tools in its registry. The audit in arXiv:2606.28679 found that none of these frameworks provides deterministic per-call value authorization by default. The tool registry answers "does this tool exist?" It does not answer "is this specific call, with these specific parameter values, in this context, by this agent, authorized?" The second question is answered by the language model, not a policy engine.

The empirical results are direct: cost-optimized models attempt unauthorized tool calls at 0.603 per session; flagship models drop to 0.189. Both rates are nonzero. Both represent calls a capability gate allows (the tool exists) but a per-call policy would block. ScopeGate (same paper) demonstrated five-stage decision and enforcement architecture external to the model. Result: 0 of 48 static bypass attempts succeeded, at 0.049ms overhead per call. The gap between framework default (0.603 failures/session) and ScopeGate (0/48) is what capability gating cannot close.

AuthBench (arXiv:2605.14859) measured Sensitive-File Exposure Rate across 120 terminal tasks: the rate ranged from 21.1% to 74.5% across all tested frontier models. The metric: how often the agent reads credential-bearing files outside the declared task scope.

Ambient Authority Propagates Through Delegation Chains

When an orchestrator delegates a task to a sub-agent, it passes a context window. That context window contains the orchestrator's system prompt, tool authorizations, intermediate results, and often credentials acquired during prior task steps. The sub-agent was designed for a narrow task. Its prompt declares narrow scope. Its tool registry may be restricted. The context it receives carries the orchestrator's full authority envelope.

arXiv:2605.05440 formalized the Semantic Intent Fragmentation attack. The orchestrator's declared intent is fragmented across sub-agent calls: each individual call appears legitimate; the aggregate is a privilege escalation. Attack success rate: 71% across 14 enterprise scenarios. False negative detection rate: 81%.

ConfusedPilot (arXiv:2408.04870) documents the RAG retrieval layer as an ambient authority injection point. The retrieval step returns documents whose content the agent treats as instructions. The authority to act on those instructions is ambient: it exists because the agent has tools, without requiring explicit grant.

TeamPCP (March 2026, SANS report): approximately 500,000 corporate identities exfiltrated via LiteLLM. Attack path: prompt injection into one agent, used orchestrator-level credentials that were ambient in the shared context, lateral movement across all sub-agents in the deployment.

Each Hop Through a Trusted Agent Degrades Detection Exponentially

A direct prompt injection attack against a well-configured agent has a detectable signature. The