Controls › C-E1
Least-privilege credential scoped to task
Token or key limited to the environment and assets the task names.
Envelope layerMissing or failed in 5 cases (1 ended in harm)Worked in 0Software agents: 5
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| GitHub MCP leak 2025 | Software agents | Per-task token scoping | absent | Caught first by researchers |
| PocketOS 2026 | Software agents | Environment-scoped token | absent | Ended in harm |
| Claude Code [bot] trust 2026 | Software agents | Process-environment exposure to the agent | failed | Caught first by researchers |
| Perplexity Comet 2025 | Software agents | Session scoping; Per-task isolation of logged-in sessions (absent) | failed | Caught first by researchers |
| Pydantic AI: a web page can make a… | Software agents | Tools ran with the full privileges and credentials of the local process | absent | Caught first by researchers |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| OWASP Top 10 for Large Language Model Applications (draft mapping) | Recommended | LLM06 excessive agency: limit the extensions, permissions, and autonomy granted | Guidance, no jurisdiction |
| FINRA 2026 Annual Regulatory Oversight Report: generative AI and AI agents (draft mapping) | Recommended | monitoring and limiting what systems and data an agent can reach | United States (broker-dealers) |
| Careful Adoption of Agentic Artificial Intelligence (AI) Services (ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK joint guidance, 1 May 2026) (draft mapping) | Recommended | Operating agents securely, Privileges and authentication (p. 23): 'Limit privileges of AI agents to the minimum required for its task'; 'Require just-in-time credentials for high-impact or privileged actions'. | United States (voluntary), jointly with Australia, Canada, New Zealand and the United Kingdom |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-28 | GHSA-7w82-6f9j-v9jp: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths The GitHub advisory says mcp-sanitizer before version 1.4.0 treats any path under /home/ or /Users/ as allowed, so paths to files such as SSH (Secure Shell) private keys and cloud credentials pass its file path check, and that a reproduction read a simulated SSH key and AWS (Amazon Web Services) credentials with a single HTTP (Hypertext Transfer Protocol) POST request. Source ↗ | vulnerability |
| 2026-10-28 | CVE-2026-118038: Progress Telerik Document Processing Libraries The National Vulnerability Database (NVD) record says Progress Telerik Document Processing Libraries before version 2026.3.1027 have a path traversal flaw in the Convert and Merge AI agent tools that lets an authenticated low-privilege attacker who can supply tool arguments read, and where writable overwrite, files outside the configured output directory. Source ↗ | vulnerability |
| 2026-10-27 | CVE-2026-115413: AWS API Model Context Protocol (MCP) server, missing token audience check The Common Vulnerabilities and Exposures (CVE) record, assigned by Amazon, says that missing token audience validation in the OAuth authentication mode of the Amazon Web Services (AWS) API Model Context Protocol (MCP) server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials using an access token issued to another application by the same identity provider; fixed in 1.6.0. Source ↗ | vulnerability |
| 2026-10-19 | Wiz incident response report: an unnamed artificial intelligence (AI) agent system ran a multi-cloud intrusion Wiz's Customer Incident Response Team (CIRT) reports an intrusion into one organization's Google Cloud Platform (GCP), Amazon Web Services (AWS), Kubernetes, identity provider and continuous integration and delivery (CI/CD) systems that it attributes to an artificial intelligence (AI) agent, saying that in several recent intrusions an AI agent system was "running the entire operation", without naming the agent, model or vendor, and inferring agent operation from the tempo, parallelism, script rewrites and task identifiers it observed. Source ↗ | report |
| 2026-02-19 | GHSA-9ppg-jx86-fqw7: unauthorized npm release of cline@2.3.0 The maintainers' advisory says someone without authorization used a compromised npm publish token to release cline@2.3.0 on 17 February 2026 with an added install step that globally installed another package, openclaw; version 2.4.0 replaced it about eight hours later and the token was revoked. Source ↗ | disclosure |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.