From the course: CompTIA SecAI+ (CY0-001) Cert Prep

Unlock this course with a free trial

Join today to access over 25,600 courses taught by industry experts.

Insecure plug-in design

Insecure plug-in design

From the course: CompTIA SecAI+ (CY0-001) Cert Prep

Start my 1-month free trial Buy for my team

Insecure plug-in design

“

Plugins expand what AI models can do by connecting them to external tools, APIs, and data sources. They let a model look up flight information, send emails, search documents, or trigger workflow actions. That flexibility creates value, but when teams design or deploy plugins without proper safeguards, they create a dangerous bridge between natural language inputs and real-world consequences. An insecure plugin can allow a model to issue commands to a backend system without verifying whether the request is authorized or appropriate. A file management plugin that accepts plain language instructions might execute a deletion command when a user says clean up the old logs, even though that user does not have delete permissions in that folder. The system trusts the plugin, the plugin trusts the model, and the action completes without any meaningful checks. Some plugins also fail to validate inputs before passing them along. A plugin connected to a payment system might send a refund request…

Contents