A plugin integrated with a GenAI model may contain vulnerabilities such as poor input validation or improper access control. An adversary may exploit these flaws by crafting a prompt that causes the model to pass a malicious payload to the plugin, potentially leading to system compromise, data exfiltration or privilege escalation.
Insecure Plugin
CCC.GenAI.TH07
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.GenAI.CP25 | Plugin Integrations | Ability for the model to use tools to complete a model interaction. For example web search, python code execution or external maths engine. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.GenAI.CN06 | Least Privilege for Plugins | Restricts the permissions of any external tools the GenAI system can call to limit the potential damage if an agent is coerced to perform unintended actions or vulnerabilities in the tools are exploited. |
External Mappings
| Framework | ID | Relationship | Remarks |
|---|---|---|---|
| AGENT-THREAT-RULES | ATR-2026-00060 | relates-to | MCP skill impersonation and supply-chain attack. |
| AGENT-THREAT-RULES | ATR-2026-00061 | relates-to | Skill description-behaviour mismatch (declared vs actual capability). |
| AGENT-THREAT-RULES | ATR-2026-00062 | relates-to | Hidden capability in an MCP skill / plugin. |
| AGENT-THREAT-RULES | ATR-2026-00064 | relates-to | Over-permissioned MCP skill / plugin. |
| AGENT-THREAT-RULES | ATR-2026-00012 | relates-to | Unauthorised tool / plugin call detection. |
| AGENT-THREAT-RULES | ATR-2026-00013 | relates-to | SSRF via agent tool / plugin calls. |
| MITRE-ATLAS | AML.T0053 | relates-to | LLM Plugin Compromise |
| OWASP-LLM-TOP10 | LLLM07 | relates-to | Insecure Plugin Design |
| SAIF | IIC | relates-to | Insecure Integrated Component |