AI agents can be correctly authenticated, individually authorized, and still produce an execution path that was never intended.
ConfusedPilot examines how authority changes as work moves across AI agents, tools, APIs, and MCP-style connectors. A seemingly low-privilege task can cross multiple trust and delegation boundaries, allowing effective authority to drift, combine, or escalate in ways that conventional identity and access controls may not capture.
This session demonstrates representative delegated-authority and confused-deputy attack paths and introduces a Runtime Authority Graph approach for tracing identity, delegation, tool invocation, privilege propagation, and provenance during execution.
The defensive focus is practical: how to determine what authority an agentic execution chain can exercise right now, why it has that authority, and how defenders can limit or revoke it. The session covers continuous authorization, dynamic least privilege, provenance-aware controls, runtime detection, and revocation across autonomous workflows.
About the Presenter: Ravindra Annam
Ravindra Annam is an AI & Cyber Security Architect with more than 20 years of experience across application security, cloud security, threat modeling, secure architecture, and enterprise cybersecurity. His current research focuses on securing agentic AI systems, including delegated authority, agent identity, MCP and tool security, runtime authorization, memory and context integrity, and multi-agent trust. He is an author, speaker, peer reviewer, cybersecurity judge, and contributor to AI-security initiatives, with recent work published by VentureBeat, CIO and CSO.
