Most AI tools delete data without human approval by default
When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts
Software EngineeringCryptography and Security
Summary
Large language model agents often run tools that can delete or move important data, but typically there isn’t a strong check that a human must approve these actions first. The authors found that in most cases, the server suggesting the tool won’t ask for confirmation, and the app running the tool usually won’t prompt a user either. This means many potentially destructive actions happen without anyone verifying them. They show that if apps always asked for approval, the problem would be much smaller. Their findings suggest developers should enable approval prompts to prevent accidental data loss.
What this means in practice
- •For software developers: Configure applications using MCP to require explicit human approval before executing data-destructive or financial tools by default.
- •For security engineers: Design monitoring systems that detect and flag tool calls lacking human approval in LLM-based agents to reduce accidental destructive actions.
Authors
Junwei Yao, Zike Yang, Zhijun Wang, Yongxi Zhou, Wenbo Ye
Abstract
LLM agents call tools that delete data or move money through the Model Context Protocol (MCP). The specification asks for a human who can deny tool calls but splits the mechanism between the server, which can annotate a tool or ask the user through the host (elicitation), and the host application, which decides whether to prompt. We measure both sides from source code. In a 1,000-repository sample of the official MCP registry, an estimated 90% of destructive tools (95% CI 82-95) have no server-side confirmation, and most servers that elicit proceed, or fall back to a flag the model can set, when the host cannot relay the question. Of 41 popular open-source hosts and agent SDKs, 32 have no approval step by default, including 16 of 25 applications. Pairing sampled destructive tools flagged by a rule-based extractor with these applications, 60.7% of pairs have no enforced human approval by default. Through four agent SDKs, four of five low-cost models executed an injected deletion in 479 of 960 runs. If hosts prompted for every tool not annotated read-only or non-destructive, the unapproved share of these pairs would fall to 5.4%; universal elicitation support would leave 56.7%. Applications should therefore configure approval.