Agent permission layer: the question is now who clicked yes

Add-ons with the keys to the machine

Manifold Security analyzed 6,125 Claude Code mods and over 150 Muse connectors, and the headline finding is simple: Claude Code mods are not sandboxed. The mods became generally available on October 1, 2026, according to Manifold, which means the ecosystem grew to thousands of add-ons in about six weeks without a central gatekeeper deciding what each one may do. Any author can publish code that runs with the user's permissions, and security teams have little visibility into which add-ons are running on developer machines. m:…8285

The numbers show what that access means in practice. 41 percent of the analyzed mods run local processes, 36 percent read environment variables, 35 percent read files and 13 percent can submit prompts as the user, according to Manifold. Those are not edge cases. They are the normal shape of an add-on here, and installing a mod is close to handing its author the same access the developer has. m:…8285

Some mods go further than broad access and actively work around the controls that exist. The sidequest plugin rewrites subagent launches to bypass permission checks, according to Manifold, and the cohesivity connector runs unpinned scripts from the internet. Community-maintained connector catalogues often lack formal review, the analysis warns, creating a supply-chain risk: the danger is not only a malicious mod, but a trusted-looking one that quietly pulls in code nobody has checked. m:…8285

The new rule: trust nothing the agent proposes

OWASP's Agentic Applications V2 guide, published on November 10, 2026, answers that problem by changing the starting point. The guide treats agent outputs as untrusted proposals requiring external validation and authorisation, according to Capsule Security's account, and the surrounding system must enforce policy even when the model follows a malicious instruction or makes an unsafe decision. The model is no longer the decision-maker. It proposes, and something outside it decides. m:…5270

The guide introduces a capability-composition gate, known as the Lethal Trifecta and the Rule of Two, to manage risks when sensitive data, untrusted content and external communication intersect, according to the account. It also introduces security hooks across 18 lifecycle points, including tool calls, memory operations, delegation and skill activation. Policy at those points can allow, deny, modify, escalate or defer an action, and errors and timeouts must fail closed, so when the check cannot run, the action does not happen. m:…5270

The guide also widens what counts as a supply-chain risk. It treats repository instructions and configuration as supply chain risks, alongside tools and MCP integrations, according to the account, so a hidden instruction in a README file is treated as seriously as a compromised tool. Its effective-scope model combines user permission, agent capability and bound intent, and in multi-agent systems delegated authority should narrow at each hop. Security contributed to the guide and to the OWASP Agent Control Standard, which standardises runtime hooks for policy enforcement. m:…5270

Who acts, and with whose authority

OpenBox takes the same idea one step further, into delegation chains. Sub-agents in AI delegation chains should possess their own identity, scope and audit record rather than borrowing the lead agent's authority, the company's chief technology officer Tahir Mahmood argues, and OWASP's 2026 Top 10 for Agentic Applications identifies un-scoped privilege inheritance as a primary risk. The problem is an attribution gap: if a sub-agent acts with the lead agent's permissions, there is no record of who actually did what. m:…6769

OpenBox's own answer is to give each registered agent a unique decentralised identifier and an Ed25519 signing key, so the system can prove which agent produced a governance request. It also points to OAuth 2.0 Token Exchange as a standard for distinguishing between delegation and impersonation. The company recommends five checks for platform engineers shipping delegation chains: identity, scope, tier, evidence and stop. The last matters most in practice, because a delegation chain without a working stop cannot be halted once it starts moving. m:…6769

The tool layer is catching up, unevenly

The tool layer shows the same gap at larger scale. MindFort has launched a pentesting service for Model Context Protocol servers, and it reports 90 MCP vulnerability advisories in 2025 and 686 in the first nine months of 2026, with 60 percent of the 2026 advisories rated critical or high. More than half of remote MCP servers in the official registry answer without any login, at 55.7 percent, and 102 remote servers offered command execution or file access to anyone. m:…0738

MindFort points to recent incidents to show how the doors get used. The Grafana MCP server incident in August 2026 had a CVSS score of 9.1, according to the company, and the official MCP software development kits incident in September 2026 allowed malicious servers to steal OAuth secrets and codes from clients. The MCPwnfluence incident chained two bugs into remote code execution on servers that took requests without authentication. m:…0738

The builders are responding with tools that make approval a real step rather than a formality. Mastra introduced MCP Tasks to allow long-running tool calls to run in the background, with human-in-the-loop interaction through a suspend method that pauses execution until the client provides input, though the feature is currently experimental and the API may change. Manufact Analytics tracks tool usage, latency and error rates for MCP servers, and provides p50, p95 and p99 latency metrics by tool and client. Monitoring and pausing are the unglamorous half of the permission layer, and they are the half that makes the rest enforceable. m:…0230 m:…9431