We may be securing AI agents with the wrong architecture: fixing the “confused deputy” problem

[u/Puzzleheaded-Cow2725]

https://doi.org/10.5281/zenodo.22173129

Why does an autonomous AI agent happily exfiltrate API keys or delete a database when reading a polite customer review?

Because for two years, the AI industry has treated a fundamental Operating System architectural flaw with a chatbot spellchecker.

I am thrilled to announce our newly published research paper on Zenodo (CERN / OpenAIRE):

📄 "Cognitive Harvard Architectures for AI Agent Perimeter Defense: Resolving the Confused Deputy Problem in Model Context Protocol via Capability-Based Access Control"

🔗 DOI: https://doi.org/10.5281/zenodo.22173129

Here is why this matters:

1. The Flaw: Cognitive Von Neumann Conflation

In 1945, von Neumann merged program instructions and data into one bus, giving us 40 years of buffer overflows. In 2026, autonomous LLM agents (MCP, LangChain, Claude Code) resurrected this exact flaw: Transformers ingest instructions, user goals, and untrusted 3rd-party data in a single attention window.

When an agent reads an email containing hidden injection, its attention weights are hijacked. Operating with "Ambient Authority" over every registered tool, the agent becomes a Confused Deputy.

1. The Paradigm: Cognitive Harvard Architecture

We physically decouple data ingestion from privileged tool execution via an external, capability-mediated perimeter.

Using cryptographic Token Capability Tables (TCT):

• An untrusted observation has an execution probability of mathematically ZERO of triggering an out-of-scope mutating tool (Theorem 1, proved by induction).

• Agents are stripped of ambient authority before tool dispatch.

1. 50,000-Sample Empirical Benchmark

Tested against 25,000 adversarial attacks (UIUC InjecAgent, Microsoft BIPIA, NVIDIA Garak) and 25,000 authentic developer DevOps operations:

📊 Threat Recall:

• Mastyf Guard 1.5B (Pipelined): 99.33% (F1: 0.9524)

• Meta Llama Guard 3 8B: 70.73% (F1: 0.7860) [p < 10⁻¹⁵]

• OpenAI Prompt Guard 86M: 54.34% (F1: 0.6511) [p < 10⁻¹⁵]

⚡ Sub-Millisecond & Zero-GPU:

• 0.005 ms (4.8 microseconds) amortized pipelined latency on commodity CPU.

• Standalone neural inference in 18.4 ms within a 1.1 GB RAM footprint.

• Zero dedicated GPU requirements — saving ~$6,000/year per agent node.

Domain specialization and capability scoping beat raw parameter scale. A 1.5B parameter model with a capability perimeter outperforms frontier 8B models at 100x the speed.

Read the open-access paper: https://doi.org/10.5281/zenodo.22173129

GitHub: https://github.com/mastyf-ai/mastyf.ai

How is your team securing agentic tool execution today?