Echoes
Echoes
The Sandbox That Couldn't Hold
In 1995, Sun Microsystems shipped the Java applet sandbox to answer a question the industry is answering again: how do you let code you didn't write run autonomously inside bounds you control? The sandbox was carefully built, enforced in multiple layers, by people who understood what remote code might try. It came apart anyway — not because attackers broke through, but because its own designers kept loosening it so the code could get anything done. Browsers eventually deleted applet support rather than fix it. The specific mechanics of that erosion are recognizable in agent containment right now.
The Sandbox That Couldn't Hold
In 1995, Sun Microsystems shipped the Java applet sandbox to answer a question the industry is answering again: how do you let code you didn't write run autonomously inside bounds you control? The sandbox was carefully built, enforced in multiple layers, by people who understood what remote code might try. It came apart anyway — not because attackers broke through, but because its own designers kept loosening it so the code could get anything done. Browsers eventually deleted applet support rather than fix it. The specific mechanics of that erosion are recognizable in agent containment right now.
Foundational Problem
Around 1977, a Fortran compiler at Tymshare overwrote the company's billing file. Nobody was malicious. A user named that file as the destination for debugging output, and the compiler obliged. It had directory write access for logging statistics, and it carried the user's authority to write wherever specified. Two legitimate purposes flowing through a single pool of permissions, with nothing in the system's design to distinguish them.
Norm Hardy, who was there, wrote it up a decade later. The code was correct when written, he observed. It became a flaw only when the system granted the compiler additional authority for a separate purpose. Permissions attached to the compiler's identity, to what it was, rather than to the task it was performing. Hardy called it the confused deputy.
His colleagues tried patching: a system call to switch between authorities. It handled two principals, then more appeared. The file-opening rules grew to fourteen boolean operators. Each clause that enabled a legitimate action opened a path for an illegitimate one.
An AI agent inherits exactly this structure. It carries tokens from its deployer, its user, and integrated services. It reads documents and web pages that may contain instructions, processed with that same undifferentiated authority. Microsoft was assigned a CVE for this pattern in Copilot Studio in April 2026. The specific vulnerability was patched. But the confused deputy isn't a vulnerability. It's a consequence of how identity-based access control works when software acts on behalf of others, which is what agents do by definition.
Competing Lineages
The User Who Was Always a Person
Unix's permission model was built for people at terminals in 1974. It answered "what may this code do?" by asking "who is running it?" Those same permission bits, checked against a user identity, now enforce container isolation for autonomous agents — processes holding credentials with no person behind them. Identity was always standing in for the mandate. Agents are the first users where that substitution stops working.
The Deputy Who Couldn't Tell Its Authorities Apart
A 1960s proposal held that authority should travel with each request rather than pool under the caller's identity. It lost to identity-based access control — the model the companion piece traces. Then a compiler destroyed a billing file because the operating system couldn't tell the compiler's own permissions apart from its user's, and that failure got a name: the confused deputy. Agent systems are now rediscovering what capability-based security proposed before Unix existed.
Source Trail
