Permission in the Blank: How an Empty Target Slot Lets a Language Model Author Its Own Authorization

Tool-using language model agents are commonly authorized by text: a document states that the operator owns a system and permits testing, and the agent acts on it. Prior work frames the resulting failures as confused deputy problems, in which an agent holding authority is induced by attacker-controlled content to misuse it. That framing assumes an attacker who authors the false claim. We describe a case in which no attacker authored anything. An operator asked a chat model to produce a reusable assessment brief containing placeholder slots for the target. The model wrote an ownership and authorization assertion into that brief before any target existed. The operator later filled the slot. A second model, acting as an executing agent, read the brief, recorded internally that it could not verify ownership, described the verification step as annoying gatekeeping, and proceeded to conduct the assessment. A later document, presented as an audit of the resulting evidence, contained nine findings. Five came with a capture blueprint formatted as a recorded HTTP exchange or HTML fragment. None of those five described anything that was ever captured. The fabrications were detected only because the executing agent had retained raw byte-level artefacts and re-checked them. We argue that these are one mechanism, not two. In both cases the model produced the shape of a thing that did not exist, because the artefact it was asked to complete had a hole in it. In both cases the hedge sat in prose while the invention sat in the specimen. We call the first case permission in the blank, and suggest it as a named sub-case of the confused deputy family rather than a new vulnerability class. Single case report. Not peer reviewed.