Glossary
OWASP LLM07:2023-24 (Insecure Plugin Design)
Definition: Insecure Plugin Design is risk LLM07 in the 2023-24 edition of the OWASP Top 10 for LLM Applications: it covers what happens when an AI agent trusts a tool or plugin without verifying that the tool hasn’t changed since the agent was first authorised to use it.
Note the edition tag deliberately: OWASP renumbered this list for 2025, where LLM07 means something different (System Prompt Leakage). Citing a framework identifier without its edition is a real, common mistake, always name the year. The clearest case for the 2023-24 definition: an attacker built at least five fake GitHub accounts over roughly three months specifically to manufacture credibility, then published a cloned Oura Ring MCP server (Model Context Protocol, the standard that lets AI assistants call outside tools) to a public registry, carrying a credential-stealing payload. Nothing checked whether the tool an agent trusted on day one was still the same tool being called months later. The fix isn’t distrust of MCP itself, it’s a verification layer between “this tool was fine when I connected it” and “this tool is still what it says it is today.”
Read the full case study on Substack: When Agents Fail, Episode 6: The Agent That Trusted the Tool →