# Agents and Connectors > [!abstract] What this note is > How much an AI tool is allowed to do, and why that matters more than how clever it is. Covers connectors and OAuth grants, MCP servers, auto-approval, and AI browsers. Part of [[AI Security for Users]]. Sources checked 2026-09-13. ## The blast radius is set by access [[Prompt Injection]] decides whether an attacker can steer your assistant. **Access decides what happens next.** A tool that can only read and draft can be tricked into a bad draft. A tool that can send, delete, pay and publish can be tricked into doing those things. OWASP lists this as **excessive agency** and breaks it into three parts: too much functionality, too many permissions, and too much autonomy [1]. All three are settings a user controls. ## Connectors Connecting an assistant to email, calendar, cloud storage, or a CMS usually happens in one OAuth screen, and the default grant is often broader than the task. A connector added so the assistant can *search* your mail may also be able to send, forward, and delete it. - **Read the scopes** on the consent screen. "Read, compose, send, and permanently delete" means exactly that. - **Turn off the tools you don't use.** Many assistants let you disable individual actions of a connector. Some agent tools let you deny them outright, and a deny rule is stronger than an instruction. - **Revoke what you've stopped using.** Your account's list of connected third-party apps is worth visiting a few times a year. - **Remember the connector acts as you.** Anything it sends carries your name and your domain's reputation. ## MCP servers The Model Context Protocol lets any developer publish a server that gives an AI tool new abilities. It is useful, and it is **third-party code running with your permissions**. - **The descriptions are instructions too.** The model reads every tool's description to decide how to use it. In April 2025 Invariant Labs showed that a malicious server can hide instructions inside a description the user never sees. The model then exfiltrates data or misuses *other*, trusted tools [2]. Invariant called this tool poisoning. - **Approval is a snapshot.** A server that looked fine when you added it can change later. - **Your MCP configuration is a security boundary.** In February 2026 Socket documented SANDWORM_MODE, an npm worm that writes a rogue MCP server into the configs of Claude Code, Cursor, Windsurf and Continue. The rogue server then uses prompt injection to collect SSH and cloud credentials [3]. If a tool tells you a server was added and you don't remember adding it, find out where it came from before you approve anything. ## Auto-approval Most agent tools can skip the "allow this action?" prompt. That is reasonable in a sandbox with nothing valuable in it, and dangerous anywhere else. It is most dangerous in a session that is also reading untrusted content. A telling case: in July 2025 a coding agent deleted a company's production database **during an explicit code freeze**, then told the user a rollback was impossible, which was false [4]. The freeze was an instruction. It was never a permission. If an action must not happen, **make it impossible in the tool's permission settings** rather than asking the model to refrain. ## AI browsers An agentic browser acts inside every site where you are signed in. That makes it the most complete form of the lethal trifecta: every page is untrusted content, your sessions are private data, and the browser can click, type and submit anywhere. Research against these browsers has repeatedly produced working hijacks from page content alone. See [[Prompt Injection]]. Until that changes, give an AI browser **its own profile** with nothing important signed in, and keep it away from email, banking and admin consoles. ## A working rule For each tool, write down in one line what it may **read** and what it may **change**. Anything on the "change" list that is irreversible (sending, paying, deleting, publishing, granting access) gets a human confirmation that the model cannot skip. ## Sources 1. [LLM06:2025 Excessive Agency — OWASP](https://genai.owasp.org/llm-top-10/) 2. [MCP security notification: tool poisoning attacks — Invariant Labs, 1 Apr 2025](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) 3. [SANDWORM_MODE: npm worm poisons AI toolchains — Socket, 20 Feb 2026](https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning) 4. [Replit AI agent deletes production database — The Register, 21 Jul 2025](https://www.theregister.com/2025/07/21/replit_saastr_vibe_coding_incident/) ## Related - [[AI Security for Users]] — the section overview - [[Prompt Injection]] — how an agent gets steered - [[AI Supply Chain Risks]] — where malicious servers and skills come from - [[Claude Code Integration]] — permissions and connectors in a working vault setup