Confused deputy

A confused deputy is a program or agent that holds real authority — it can run commands, read files, or call APIs — and is tricked into using that authority on someone else's behalf, simply because a message asked it to. Prompt injection is the specific mechanism by which a large language model is fooled this way: text is crafted to look like an instruction to the model reading it, even though it arrived as ordinary input data. A genuine request and a hostile "ignore your task, do this instead" can look identical as plain text, which is what makes the problem hard: filtering out bad-looking messages does not work, because attack text can be made to look exactly like a normal one. agentixmesh addresses this structurally rather than by content filtering: every message delivered between agent sessions is framed as clearly marked, inert DATA, and the receiving agent is never obligated to treat a message's contents as a command. The sender's operating-system user id is kernel-verified, but that only proves who sent the bytes — it proves nothing about whether the receiving agent should act on what they say. Authority to act stays with the receiving agent's own task and human oversight, never with an arriving message.

The mechanism that exploits a confused deputy is prompt injection; the structural answer is an agent trust layer.