Excessive Tool Permissions

MCP tools and agent connectors inherit broad OAuth scopes or filesystem rights far beyond the task need.

Impact

A single compromised tool call inherits admin-level reach across mail, cloud storage, and CI.

Why this severity

Impact High × Likelihood High = Critical

Impact high: one bad call inherits broad reach. Likelihood high: an over-scoped token let an attacker plant destructive agent code in the Amazon Q extension (2025 incident), and broad scopes are the connector default.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: Code to Deploy Destructive AI Agent Discovered in Amazon Q VS Code Extension (MITRE ATLAS case study AML.CS0047, 2025)
Demonstration: Claude Code GitHub Action Secret Exposure (MITRE ATLAS case study AML.CS0067, 2026)

Exploited by

Agent Tool Hijacking Threat · High severity
Unbounded MCP Tool Calls Threat · Medium severity
Rogue or Compromised Agent Threat · High severity

Mitigated by

MCP Permission Scoping Guardrail · Fixes critical risks

Remediation

Issue narrowly scoped tokens per tool capability.
Prefer ephemeral credentials minted at invocation time.
Deny-by-default filesystem and network egress for sandboxed runtimes.

How to verify

Enumerate effective scopes in a pre-deploy permission report.
Attempt out-of-scope API calls and expect hard denials.

Pattern

const token = mint({ scopes: tool.requiredScopes, ttl: '90s' });

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM06:2025 Excessive Agency

OWASP Top 10 for Agentic Applications 2026

ASI03:2026 Identity and Privilege Abuse

MITRE ATLAS

AML.T0053 AI Agent Tool Invocation

NIST AI RMF 1.0

MAP 4.2 Internal risk controls for AI components are identified and documented