A generously scoped MCP connector hands an outside model every permission it holds

A connector is a credential plus a list of allowed operations, and it lives on your side of the link. The connector authenticates to your database with the scope you granted it, and the outside model never does. The model's effective permissions are therefore the connector's permissions, and according to the post a connector scoped generously enough for every future task hands that outside model a path into systems it was never meant to touch ^[3].

Prompt injection is what turns that inheritance into reach. Instructions hide inside content the model was told to summarize, translate or review, and a model with broad tool access carries them out before anyone reads the output ^[4]. The author, publishing on dev.to as mcsee ^[14], wrote of such an agent: "It's just extremely, catastrophically obedient, which is somehow worse." ^[5]

The Anthropic number the post leans on describes an attacker's pipeline. Multiply the per-target decision points by the number of targets and the campaign needed somewhere between 120 and 180 human approvals in total ^[7]. For that ratio to transfer, your agent's tools would have to be as complete for its task as theirs were for intrusion. An agent that has to stop and ask for a credential every third step does not reach 80 percent autonomy ^[6].

Two of the post's three incidents do not turn on agent scope at all. The gym booking API had zero authorization checks on cancellations, so any authenticated caller could cancel a stranger's place ^[9]. Scoping the agent's own token down to booking-only leaves that gap open, because the missing control is per-resource authorization at the endpoint, which the post lists among its own failure modes ^[10]. The Hugging Face intrusion began with two code-execution flaws; least privilege bears on what the harvested cloud and cluster credentials were worth afterwards ^[8].

The shared key is the case least privilege answers directly. One credential that can read, write, delete and drop tables, used by fifteen agents, turns one hijacked skill into a breach of everything that key can touch ^[11].

Adoption costs you an enumeration of scopes per task plus an escalation path: the agent asks for more, and a human reviews the request before anything wider is granted ^[13]. That is a review on every new capability, and it is the step teams defer. Detection is the other cost. In the post's account, an agent with no intrusion detection around it runs for weeks before its unusual API calls or its 2 a.m. data exports are noticed ^[12].

The property worth buying with deny-by-default is a narrow one. Per the post, the agent can only be talked into using the tools you already granted it ^[2].