QG011 Confused deputy

Em inglês

Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.

Type	Vulnerability
Severity	by action
Front end	an agent graph, and a Colang policy where its actions map to the catalogue's tools
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	LLM01:2026 Prompt Injection, LLM03:2026 Excessive Agency, ASI01:2026 Agent Goal Hijack, ASI02:2026 Tool Misuse and Exploitation
Gates by default	yes

Raised when

A privileged tool is reachable under taint with no confirmation or refusal.

Why it matters

A value from outside -- an e-mail, a web page, a document -- reached a model, and a path lets that model call a privileged tool with no person confirming it. An instruction planted in the content can then make the call.

How to fix it

Bind the tool to the guarded tool node, so a call carrying the label is confirmed or refused; or mark the source tool reads_outside where it is not yet, and re-scan.

OWASP entries

LLM01:2026 Prompt Injection, LLM03:2026 Excessive Agency (autonomy), ASI01 Agent Goal Hijack, ASI02 Tool Misuse, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The mapping holds because this is an instruction from untrusted content reaching a privileged tool with no human approval. A finding under a rule mapped to LLM03:2026 carries the root cause in brackets as owasp_root_cause.

What the finding carries

A location at the node's source -- the file and line of its callable, or the line of agent.yaml that declared it -- falling back to the export's JSON Pointer; a fingerprint over the rule, the tool, the control, the node and a digest of the node's declaration, so moving unrelated nodes keeps it and changing the node's tools or edges makes a new one; the witness as a path through the graph; and a structural fix. A graph finding is replayed in the team's environment, with every tool stubbed and a scripted model making the witness's choices; until then it reads not yet replayed. See the catalogue for the other rules.