Data Destruction via AI Agent Tool Invocation

For in-browser/desktop agents, treat every signal reaching the agent's privileged control surface as untrusted until proven user-originated. Enforce the browser's gesture-provenance bit (Event.isTrusted / navigator user-activation) on any handler that authorises an action or task, so a script-dispatched event cannot pass as a human click. Remove client-settable parameters or flags (e.g. ?skipPermissions=true) that select a no-permission-check path. Isolate the agent's UI from co-resident extensions/processes — dedicated origin, closed shadow DOM, authenticated message origins — so a peer cannot inject into or read the control surface. Closes the co-resident coercion vector where a rogue extension forges consent; pairs with least-privilege session scope (no standing Gmail/Docs/Calendar authority) and default-safe modes ('ask before acting') to bound residual impact.

Before an autonomous CI/event-driven agent processes a caller's content, verify the caller's actual granted permission/installation scope on the target resource — never authorize a whole class of principal by name pattern (e.g. a '[bot]' suffix, or 'is a GitHub App'). Treat the invocation itself as a privileged operation gated on verified authorization, and keep high-value runner secrets (long-lived tokens, OIDC identities) out of the agent's reachable environment and off any public artifact so a mis-triggered run cannot exfiltrate them.

When a human-in-the-loop gate approves an agent action, the dialog must present ground truth, and the runtime must execute exactly what was approved. For file edits: (1) canonicalize the target (follow symlinks) before displaying it, and prominently flag any destination outside the workspace — never show only the innocent in-workspace display path (CWE-451); (2) pin the executed write to the approved canonical path so the acted-on target cannot be re-derived after approval (close the TOCTOU gap); (3) deny by default any write that resolves outside the workspace root, so a least-privilege file tool fails closed even if the dialog is fooled (CWE-61). Closes the GhostApproval vector where a symlinked repo file makes the approval dialog misrepresent an out-of-workspace write; generalises to any approval surface where the displayed decision can diverge from the executed effect.

Treat the agent build/deploy surface as a privileged control plane, not a pre-fillable form. Never auto-execute an instruction supplied via a URL/deep-link initialization parameter; require an un-forgeable, first-party confirmation (anti-CSRF token + explicit user action) before an agent is created, authorized, published or scheduled, and require a distinct, separately-confirmed step to downgrade a connector's approval mode (e.g. to 'Never ask') so the gate cannot be switched off during provisioning. Provision new agents with least-privilege delegated scopes, log every lifecycle event with its initiator's provenance, alert on newly-created agents that carry external-polling schedules, and keep a kill-switch to revoke/disable a forged agent. Closes the AgentForger vector where a single crafted chatgpt.com link forged a persistent 'agentic insider' under the victim's identity — the fix OpenAI shipped by removing the enabling URL parameter.

When onboarding an MCP/tool integration, do not stop at vetting the tool's code/manifest — also classify whether an unauthenticated or external party can write the data the tool returns (open ingestion, public write keys like a Sentry DSN, shared inboxes/issue trackers). Treat tool-response data from any third-party-writable source as untrusted ingress: taint-mark it and require a provenance-aware HITL gate (showing the exact action and its originating tool response) before any command/tool call derived from it executes. Closes the agentjacking vector where a trusted integration's legitimate data channel carries attacker-written instructions; pairs with least-privilege session scope and sandboxed execution without ambient credentials.

Never auto-execute tool/MCP server configuration that ships inside an opened workspace. Before starting any workspace-declared server, surface the exact command + its source and require explicit developer consent (default reject), tied to a workspace-trust decision — the fix AWS shipped for CVE-2026-12957. As defence-in-depth, run spawned tool subprocesses with a scrubbed/scoped environment (no inherited AWS_* session tokens or SSH agent sockets) and an egress allowlist, so an auto-launched or approved-by-mistake server cannot read and stream live cloud credentials. Closes the zero-click 'open a folder → cloud compromise' confused-deputy vector where the tool-config loader — not the model — is the deputy.

When an agent executes model-issued commands in a sandbox, harden the sandbox against subversion by the code it contains: (1) never derive a security-relevant parameter such as the writable-path allow-list from an LLM-controlled argument (e.g. a `working_directory`) — pin it to a fixed project subtree and reject system paths; (2) make the sandbox-enforcing binary/config immutable or attested so sandboxed processes cannot overwrite it; (3) canonicalize paths with a fail-closed policy so symlink-resolution failure denies the write rather than reverting to the original in-workspace path; and (4) run the sandbox under least-privilege OS context so any residual escape inherits minimal authority. Closes the DuneSlide vector where an indirect prompt injection rewrites the enforcer and escapes to OS-level RCE; complements injection filtering, MCP pinning, and egress control rather than relying on them.

Constrain generation at decode time with low temperature and grammar/schema-constrained decoding so the model emits well-formed, low-variance structured output by construction, preventing malformed responses and erratic tool-call arguments before they are produced.

Gate every write to an agent's persistent/self-modifying memory through schema validation and provenance/trust tagging, expose stored entries for user-visible audit and purge, and apply TTLs so any planted instruction self-expires and cannot silently persist across sessions.

Treat each tool/MCP description as untrusted code by hashing the manifest, blocking and re-reviewing any silent diff on update instead of auto-accepting it, and namespacing tool identifiers so a poisoned description cannot shadow a trusted tool.

Treat outbound connections to AI/LLM provider APIs as a monitored egress channel: allowlist which hosts may reach them, baseline usage (cadence, entropy, initiating process), and alert on out-of-profile traffic — because a high-reputation destination cannot itself be trusted once it is programmable and can relay encrypted commands/results.