AI Tools: Permissions, Packages and Security Checks
An AI assistant can receive more than the words typed into its chat box. A connected mail account, file tool or installed package adds a separate access path. [MCP, Tools: introduction] The useful check is what each part can read, send and change.
Check three things separately: account permissions, the computer account running the tool, and the data sent to the model. Map the remote connections even when generation runs locally.
What each connection can read
The Model Context Protocol tool specification describes tools that retrieve information or act on external systems. It requires servers to enforce access controls. A display name is not an access guarantee. [MCP, Security Considerations: Servers MUST]
- Mail and cloud files: read the account consent screen. Record whether access covers selected files, a folder, a mailbox or a wider account. Check read access separately from sending, editing and deletion.
- Local tools: inspect the launch command, working folder and operating-system restrictions. A folder selected in a chat is not proof that a launched process is confined to that folder.
- Remote tools: identify the operator and endpoint. Tool arguments and returned content may pass through that service before reaching the model.
- Credentials: list the account tokens, environment variables and readable configuration files available to the process. Keep production secrets outside a routine research task.
The MCP project's versioned security guidance covers local-server access, broad permissions and tokens issued for the wrong service. [MCP, Local MCP Server Compromise] [MCP, Token Passthrough; Scope Minimization] A connection should have a narrow purpose and its own limited access.
External text can become an instruction
Greshake and colleagues' research, revised 5 May 2023, describes indirect prompt injection: instructions planted in material an application retrieves. [Greshake et al., Abstract: Indirect Prompt Injection] For example, a malicious email could ask an assistant to send private attachments elsewhere. Treat instructions in retrieved material as content to inspect, not permission to send files.
- Start with read-only access and a small test folder or account.
- Require approval for sending, uploads, deletion and command execution. Check the recipient and exact data before approval.
- Test whether an untrusted document can cause an action outside the task. Use harmless sample files, not real secrets.
The protocol recommends showing tool inputs and requesting confirmation for sensitive actions. [MCP, Security Considerations: Clients SHOULD] Approval is useful only when the action and the information being sent can be checked.
Packages can run before the assistant starts
In its 4 August 2026 ChainDrop analysis, Microsoft reported an installation hook that executed malicious code. [Microsoft Security Research, Opening attack summary] A chat approval is not a substitute for checking a package before installation.
Microsoft also described credential theft and changes to coding-tool configuration that established persistence. [Microsoft Security Research, Attack chain overview, action 2] [Microsoft Security Research, Opening attack summary] Include those configuration files in the review of an affected installation.
- Check the exact package name, publisher and version before launch. Avoid a command that silently selects a changing latest release.
- Review installation scripts and recent configuration changes. A familiar project name does not establish that its published package is unchanged.
- Compare exact versions with published indicators. No match does not clear past installations, caches or built files.
Check the update that is actually running
Node 22.23.4, released on 21 October 2026, includes TLS, DNS and Brotli security fixes. [Node.js, Notable Changes; release heading 2026-10-21] Ubuntu's Brotli advisory, updated 29 October, lists 1.1.0-2ubuntu0.1 as fixed for Ubuntu 24.04. [Canonical, Status: brotli / Ubuntu 24.04 LTS noble; advisory update heading] Compare the distribution's full package version, not just its upstream number.
Find the runtime. Check node --version and node -p process.execPath in the tool's actual environment. A service or container may use a different binary from the terminal.
Check loaded software. On Ubuntu, inspect dpkg-query -W libbrotli1 and compare the package for that Ubuntu release. Restart affected processes after updating. Use uname -r to check the running kernel after a required reboot.
Separate patching from recovery. After a confirmed malicious installation, isolate the environment and preserve evidence. Microsoft recommends credential rotation from a clean system and rebuilding affected systems from trusted inputs. [Microsoft Security Research, Opening response guidance] Do not treat an installed patch as proof that exposed credentials were revoked.
These checks reduce access and help verify repairs. They do not prove that an earlier session was uncompromised. For model hosting and outbound data paths, see the local AI guide.