Convenience as Attack Surface

Features that trade safety for ease: auto-approve, always-on and one-click trust.

MCP tool poisoning succeeded 36.5% of the time across 20 models in one benchmark, and in May 2026 four coding CLIs were found to auto-run project servers once a folder was trusted. Some convenience cuts risk: passkeys sign in successfully 93% of the time against 78% for passwords with MFA.

Convenience features: success rates: Passkey sign-in success 93%; Password plus MFA sign-in success 78%; Sign-ins by passkey, 2026 36%; MCP tool poisoning success, average 36.5% CONVENIENCE FEATURES: SUCCESS RATES Passkey sign-in success 93% Password plus MFA sign-in success 78% Sign-ins by passkey, 2026 36% MCP tool poisoning success, average 36.5% PERCENT
Accounts with a passkey
42%
Worst-case tool poisoning success
72.8%
Repos seeded by an MCP worm
73
Registry incidents
3

Evidence

Trust prompts that default to yes became the common failure

Documented cases: convenience as Attack Surface
DateCaseCountryWhat happenedSource
Apr 25, 2025Microsoft Recall rolloutUnited StatesRelaunched as opt-in after the 2024 version was pulledSource
Aug 2025CurXecute and MCPoisonUnited States and IsraelCursor auto-ran new MCP entries; approval tied to the server name, not its contentsSource
Mar 10, 2026CNCERT OpenClaw alertChinaDefault settings and excess privileges exposed agent instancesSource
May 7, 2026TrustFallUnited StatesClaude Code, Cursor, Gemini and Copilot CLIs defaulted trust prompts to yesSource

Registry

Three registry incidents involve convenience as attack surface

Registry incidents meet a stricter bar than the cases above: public sources name the developer, the failed control and who found it.

Registry incidents linked to this risk
IncidentDateAgentControl that failed
Amazon Echo Sends a Private Conversation to a ContactMay 2018Voice assistantSpoken confirmation satisfied by background speech
EchoLeak Turns Microsoft 365 Copilot Into a Data LeakJan 2025Enterprise copilotUntrusted email could direct the copilot to privileged data
Cursor Agent Deletes the PocketOS DatabaseApr 2026Coding agentFull-permission API token and a delete with no confirmation

Exposure

14 of 17 agent types rate very significant or critical on integrations and permissions or data capture and retention

From the attack surface ratings, the agent types where this risk has the widest path in.

Agent types most exposed
Agent typeDimensionRating
Ambient sensorsData capture and retentionCritical
Workflow agentsIntegrations and permissionsCritical
Enterprise agentsIntegrations and permissionsCritical
Robotaxis and autonomous vehiclesData capture and retentionVery significant
DronesData capture and retentionVery significant
Fleets and swarmsData capture and retentionVery significant
Phones and tabletsIntegrations and permissionsVery significant
WearablesData capture and retentionVery significant
Vehicle cabin AIData capture and retentionVery significant
Smart home assistantsIntegrations and permissionsVery significant
Medical devicesData capture and retentionVery significant
Public infrastructureData capture and retentionVery significant
Coding and research agentsIntegrations and permissionsVery significant
Commerce agentsIntegrations and permissionsVery significant

Controls that bound it

Rules

China requires consent before updates and scope limits on agents

Rules that address convenience as attack surface
RuleJurisdictionWhat it requiresStatus
China agent Implementation OpinionsChinaAgents may not exceed user-authorized scopeEffective Jul 15, 2026
CNCERT OpenClaw guidanceChinaAuthentication, isolation, vetted pluginsMar 2026
UK PSTI ActUKNo universal default passwords on smart devicesIn force Apr 2024

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Risk group
Risks Hub
Datasets
ai_risk_evidence.csv (4 rows); registry incidents (3 linked); ai_attack_surface.csv
Key sources
Microsoft Recall rollout
CurXecute and MCPoison
CNCERT OpenClaw alert
TrustFall
Last verified
October 2026