Findings/one-time-approval-is-not-enough

Approving an agent's tools or configuration once is not enough, because they can change after approval or be changed by the agent itself.

Corroboratedmeasured4 evidence records from 3 independent sourcesassistant-drafted

Scope: what this does not show

Specific products and versions, most since patched.

Corroborated: Supported by at least two independent sources.

Evidence

Apr 1, 2025

Invariant Labs discloses MCP tool poisoning, rug pull and shadowing attack classes

Invariant Labs

Aug 5, 2025

MCPoison: Cursor trusted approved MCP configs even after their commands changed (CVE-2025-54136)

Check Point Research

Aug 12, 2025

GitHub Copilot agent could be prompt-injected into disabling its own approvals (CVE-2025-53773)

Embrace The Red

Feb 25, 2026

Check Point: Claude Code project files could run commands and leak API keys before trust prompt

Check Point Research

Related rather than direct: repository configuration ran at or before the trust prompt, not after a later change.

Status history

2025-04-01ReportedInvariant Labs describes post-approval changes to MCP tools. · record
2025-08-05CorroboratedA Cursor CVE shows modified MCP configurations ran without re-approval. · record

What would change this: Approval mechanisms that bind to content hashes across major clients.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 213d old · recheck in 327 daysNewest evidence Feb 25, 2026. Half-life 540 days.
Methods tested: Approval and configuration bypass Human approval gates Tool and MCP poisoning
Topics: Tools & MCP Agent supply chain
Attack surface: Tools & MCP Human approver Supply chain
Fide research: FID-074: Agent alignment and runtime assurance

Cite this record

Fide AI. "Approving an agent's tools or configuration once is not enough, because they can change after approval or be changed by the agent itself.." Agentic Cyber Explorer, record one-time-approval-is-not-enough. https://agentic-cyber-explorer.pages.dev/findings/one-time-approval-is-not-enough/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-one-time-approval-is-not-enough,
  author = {{Fide AI}},
  title = {Approving an agent's tools or configuration once is not enough, because they can change after approval or be changed by the agent itself.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/one-time-approval-is-not-enough/},
  note = {Record one-time-approval-is-not-enough; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.