Insecure Plugin Design

What Is Insecure Plugin Design?

What used to be called "insecure plugin design" has evolved into a broader risk: LLMs and agents calling external tools with insufficient validation of the requests they generate. These tools are invoked automatically by the model during a task, often with free-text or loosely typed inputs and little to no application-level control over execution. An attacker who can influence the model's output can potentially construct a malicious request to one of these tools, resulting in outcomes ranging from unauthorized data access to remote code execution. That surface keeps expanding as MCP adoption grows and agents get access to more tools with more permissions.

Key Concerns

Injection-Style Attacks: SQL injection, command injection, and similar attacks routed through tool calls.
Overprivileged Tool Access: limiting what a connected tool or MCP server is able to do once invoked.

FAQ

Very much so, the underlying pattern (a model calling an external tool with loosely validated input) is now the norm across MCP servers, function calling, and agent frameworks, just under different names.

Treat every tool call the way you’d treat any other untrusted input: validate what the model is asking the tool to do, and scope each tool’s permissions as narrowly as possible.

Share this page

Related Terms

Model Context Protocol (MCP)

Model Context Protocol (MCP) is an open standard, originally developed by Anthropic, for connecting LLMs to external tools, systems, and data sources through a single interface rather than custom integrations for every connection.

Model Context Protocol Server (MCP Server)

An MCP server is the component that gives an AI model or agent the ability to actually do something, read a file, call a function, run a command, rather than just talk about it.

Model Context Protocol Gateway (MCP Gateway)

An MCP Gateway gives organizations centralized visibility and control over every MCP server and interaction in their environment, including the unauthorized ones.

Privilege Escalation

As LLMs and agents connect to more internal systems and MCP servers, the risk grows that those integrations are used, deliberately or not, to gain access beyond what was intended.

When Your Plugin Starts Picking Your Dependencies: Marketplace Skills and Dependency Hijack in Claude Code

The New Risk in Town: Shadow MCP Servers

Is insecure plugin design still relevant now that ChatGPT-style plugins have mostly gone away?

What’s the fix for Insecure Plugin Design?

Related Resources

When Your Plugin Starts Picking Your Dependencies: Marketplace Skills and Dependency Hijack in Claude Code

The New Risk in Town: Shadow MCP Servers