A critical vulnerability affecting MaxKB illustrates the danger of allowing untrusted content to influence an agent that has access to consequential tools.
When approval boundaries fail, chat or ingested content can potentially become operating-system effects.
Tool availability is not authority
The architectural lesson is broader than one product: tool availability is not authority to invoke the tool.
A shell, MCP server, plugin or skill can be trusted and technically callable while a particular invocation remains unauthorized.
Authrizd should evaluate each consequential tool call against the agent identity, mandate, delegation, tool identity, operation, parameters, target, environment and proposed effect before execution.
Instructions can propose actions
Instructions from chat, documents, repositories, websites or memory can propose an action. They cannot authorize it.
This distinction is particularly important for coding agents that routinely consume untrusted repository content before invoking powerful development tools.
Tool availability does not confer authority.
Sources
https://securityvulnerability.io/vulnerability/CVE-2026-77521
NEXT STEP