Two recently disclosed developer-tool vulnerabilities expose the same architectural problem from different directions: protecting the AI agent interface is not enough if another technical path can reach the same consequential effect.
Research into Microsoft DevLabs’ DebugMCP described a path from a developer’s browser to a privileged debugging capability and ultimately code execution. Separately, Datadog Security Labs disclosed an OpenCode vulnerability in which a malicious webpage could reach OpenCode’s local upgrade endpoint and cause an attacker-controlled package to be installed and executed under affected configurations.
In both cases, an attacker could potentially reach privileged infrastructure without first persuading the AI model to make a bad decision.
A reachable capability is not an authorized capability
Agent infrastructure increasingly creates privileged local control surfaces: MCP servers, debugger interfaces, browser endpoints, local APIs, package-management operations, plugins and background services.
Authority enforcement that exists only in the conversational or agent layer can therefore be bypassed.
The relevant control point is the consequential effect.
Every equivalent path must converge on authority
For each governed effect, an enterprise should enumerate every path capable of producing it: agent tool call, direct MCP request, API, CLI, browser control, plugin, subagent, background process or CI runner.
If an alternate path reaches the effect without authority adjudication, the authority boundary is incomplete.
You do not control an AI agent’s authority if bypassing the agent bypasses the authority control.
Sources
https://securitylabs.datadoghq.com/articles/opencode-upgrade-remote-code-execution/
NEXT STEP