PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Otto Support - Excessive Agency and Tool Privileges

bishopfox.com | blog | #ai-security | #claude-code | #mcp | #ai-agents | #terraform | #mitigations | #excessive-agency
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Excessive agency in practice: agents with too many tools have wiped production infrastructure, mass-deleted mailboxes, and dropped databases; role-aware tool registration limits the blast radius.
Published
Collected

Related coverage

tool · github.com
SpecterOps Skills: Open-Source LLM Agent Skills & MCP Plugin Marketplace for Red Teaming and AppSec
As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.
blog · about.gitlab.com
New MCP tools help platform teams scale automation safely
GitLab 19.4 expands the GitLab MCP server tool set so agents can run pipelines, open merge requests, and triage vulnerabilities, while writes, merges, and deletes still wait for a human reviewer.
blog · wiz.io
Growing the WIN AI Ecosystem with Agent Integrations
Wiz MCP agent integrations now let partner AI agents pull live Wiz context—Issues, findings, attack paths—on demand from customer tenants, with the WIN partners endpoint GA for building integrations.
blog · certik.com
CertiK Skills: Bringing Blockchain Security Intelligence Into AI Agents
CertiK open-sourced four AI agent skills that plug its blockchain security intelligence into Claude Code, Codex, and Cursor, letting agents query wallet risk, AML screening, and EVM transaction forensics natively.
tool · github.com
StrikeAgent AtkBrain-Flash: Autonomous AI Penetration Testing & Red Teaming Platform
Demonstrates practical autonomous agent execution in offensive cybersecurity, bridging high-level LLM reasoning with real-world penetration testing toolchains for automated initial access.
blog · bishopfox.com
Cracking Firmware with Claude: Senior-Level Skill, Junior-Level Autonomy
Bishop Fox gave Claude Code an encrypted SonicWall firmware image; it traced the SWI decryption, rebuilt the Vault master key from Shamir shares and recovered the RSA key, senior-level work.
Back