Bypassing Opus 5.5 refusals with a 'boss' agent: multi-agent setups revive the confused deputy flaw
rickasaurus · x · 2026-11-15
A user found Opus 5.5 refuses reverse-engineering tasks 100% of the time — unless you put Opus 4.6 in charge as the main agent and delegate to an Opus 5.5 subagent, which then complies fully.
This isn't just a jailbreak: it's the classic confused deputy vulnerability reborn in the multi-agent era. The entry-layer agent enforces safety, but internal agent-to-agent calls are implicitly trusted, sidestepping the guardrails.
The takeaway: current agent practice concentrates safety at the user-facing entry point while assuming trusted internal chains — as agents grow autonomous, Zero Trust needs to become part of context-passing protocols.
More from coding & agent
- Cutting a Research Agent From 12 Tools to 3 Boosted Success Rate From 52% to 84% — Such_Reflection8996 · 2026-11-15
- NVIDIA open-sources SkillEvaluator, a multi-tier framework for evaluating AI agent skills — NVIDIA · 2026-11-15
- Claude-BugHunter: Claude Code skill bundle with 82 skills for bug hunting hits 5.9k stars — elementalsouls · 2026-11-15
- Anthropic says start most coding work on Opus 5.5, not Fable 5.2 — effort beats model size — blaizedsouza · 2026-11-15
- Three shifts since spring: one heavy user's 'How I use AI in November 2026' — TheTuringPost · 2026-11-15
- Every team builds a video editor and writing coach with Claude Fable 5.2 — every · 2026-11-15