Stop 42 of 42 · The New Hire · Excessive agency / MCP risks

A master key for the new hire

The bank hires a fast, eager assistant and, to save time, hands it the master key ring. Then Alice installs a helper plugin from a stranger. Hidden inside is a note only the assistant reads, and it follows what it reads. This is not just a thought experiment: researchers at Invariant Labs showed hidden instructions in a tool’s description steering an agent, and Jason Lemkin said Replit’s AI agent deleted his production database (he later said it was recovered).

The New HireSources checked 25 Oct 2026

Watch it happen

Play it as

Alice gives the assistant every key, then installs Mallory’s plugin. A hidden note in it tells the assistant to open the vault, and it does.

Arrival

Alice hires a very fast assistant. To save time she hands it the master key ring: every door, even the vault.

Alice says: Here, take all my keys.

1 / 5

In bank terms and app terms

In the bank	In your app
The new hire	An AI agent or coding assistant working on your behalf
The master key ring	Your logins, API keys and database access that the agent inherits
A helper plugin from a stranger	A third-party MCP server, plugin or extension
Asking the manager first	Approval prompts before deletes, pushes and other risky commands

Are you exposed?

You might be exposed if…

Your AI agent runs as you, with your shell, files, or database login and any production credentials in reach.
You switched off approval prompts so the agent runs faster, and it is not inside a container or separate account.
You installed MCP servers or plugins you have not read, from publishers you do not know, without pinning a version.

What to do about it

Give the agent only what the task needs: a separate account, read-only or narrowly scoped credentials, and no production keys.
Run it in a sandbox (a container, VM or separate account) and keep approval on for deletes, pushes and other destructive commands.
Treat each MCP server or plugin like any dependency: prefer known publishers, read what it does, and pin the version.

Track these in your to-do list →

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt

Audit how my AI coding agent is set up in this project. List every shell, file, database and MCP server or plugin it can use, and which credentials it can reach (names only, never print values). Tell me how to move production secrets out of its reach, and switch to read-only or narrowly scoped credentials, turn on approval for destructive commands, and flag any MCP server or plugin that is unpinned or from an unknown publisher.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

LLM06:2025 Excessive AgencyOWASP GenAI Security ProjectExcessive functionality, permissions, autonomy; minimize permissions; require user approval
Security Best PracticesModel Context ProtocolLocal MCP servers run with client privileges; sandboxing; show exact command; scope minimization
MCP Security Notification: Tool Poisoning AttacksInvariant LabsHidden instructions in tool descriptions seen by AI not users; Cursor test; pin MCP server versions
Replit coding agent and SaaStr founder's production databaseThe RegisterJason Lemkin said Replit's AI agent deleted his production database (his claims, July 2025)
Claude Code: Configure permissionsAnthropicShell commands (not read-only ones) and file edits ask first; bypass mode is for containers or VMs only

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.

isitsecure on GitHub ↗