AI Security Atlas › All entries › Autonomous Agent & MCP Security
Approvals Based on Agent-Written Summaries
The approval screen shows the agent's own explanation of what it will do instead of the exact tool, arguments, and effect.
Open in the interactive atlas →Impact
Reviewers cannot see the action they are approving, so persuasion beats verification.
Why this severity
Impact High × Likelihood Low = Medium
Impact high: approvals become rubber stamps. Likelihood low: a common design, but exploitation has not been publicly documented.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Low: No public cases yet, or the attack needs privileged or insider access.
Method: OWASP Risk Rating Methodology
Related
Exploited by
- Human Approval Manipulation Threat · Medium severity
Mitigated by
- Verifiable Action Previews for Approvers Guardrail · Fixes medium risks
Remediation
- Render tool name, arguments, and a diff from system data, not model text.
- Highlight irreversible and high-impact fields.
- Log what the reviewer saw alongside the decision.
How to verify
- Approval UI snapshot tests show raw arguments for every tool.
- Audit log stores the rendered approval view.
Framework mapping
OWASP Top 10 for Agentic Applications 2026
- ASI09:2026 Human-Agent Trust Exploitation
OWASP Top 10 for LLM Applications 2025
- LLM06:2025 Excessive Agency
NIST AI RMF 1.0
- MEASURE 2.8 Transparency and accountability risks are examined and documented