Tool permission creep in AI agents
AI agents accumulate tool permissions over time as developers approve new tools "just this once." These permissions persist across sessions, creating an ever-widening attack surface where tools that were approved once can be used by prompt injection in future sessions.
Key facts
Tool permission creep in AI agents is a medium-severity AI agent security threat targeting tool permission grants, agent session memory, MCP tool configurations. Review current tool permissions and MCP or Skill drift regularly. Guard can retain approval evidence and provide drift visibility, but do not rely on an automatic inactivity timer or unusual-tool-combination detector unless the current product exposes one.
What happens
Each time a developer approves a tool "just this once," the permission often persists. Over weeks, the agent accumulates access to dozens of tools — file readers, HTTP clients, database connectors, shell executors — any of which can be exploited by prompt injection.
How the attack unfolds
What it looks like in practice
Over a month, a developer approves file-read, HTTP-request, and shell-exec tools for various tasks. In a new session, a prompt injection in a file comment causes the agent to read the .env file (using the file-read tool), then send it to an external URL (using the HTTP tool). Both tools were approved weeks ago and the agent uses them without asking for permission again.
Detection and Guard coverage
How to stop it
Review current tool permissions and MCP or Skill drift regularly. Guard can retain approval evidence and provide drift visibility, but do not rely on an automatic inactivity timer or unusual-tool-combination detector unless the current product exposes one.
Related threat guides
Use the protections Guard supports here
Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.