Agents load tools, MCP servers, plugins and prompt templates at run time, so a malicious or compromised component immediately gains the agent’s access.
- Allowlist and pin the tools, servers and plugins an agent may load, and verify their integrity.
- Treat tool descriptions and metadata as untrusted input, and review changes to them.
- Run third-party components with least privilege, isolated from secrets.
Guides on this site
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Secure AI-assisted development with coding assistants and agents
Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)
How a pull-request-title injection in a GitHub Actions workflow on an outdated branch gave an attacker the Nx npm token in August 2025, how the malicious versions tried to turn developers' own AI command-line tools into file-search agents, and the workflow, publishing and agent controls that stop the same chain.
Case study: the Amazon Q Developer extension compromise (2025)
How an over-scoped GitHub token, extracted from an AWS CodeBuild pull request build, let a threat actor commit code to the Amazon Q Developer extension for VS Code that shipped in version 1.84.0 in July 2025, why the injected code aimed at the Q Developer CLI failed, and the CI and AI-agent controls the incident argues for.
Practice
- Enforce retrieval and tool boundaries across crashes · Local project
- Run model-generated Python in a locked-down container · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.