Plugin & Extension Security for AI: Complete Guide | QuizBy Eyal Doron / December 6, 2025 / 1 minute of reading Plugin & Extension Security for AI: Complete Guide | Quiz 1 / 7 1. What guidance does the article give for Anthropic Claude MCP security? 1. Allow all MCP tools without restriction 2. Use only public MCP endpoints for convenience 3. Host MCP servers internally – authenticate via mTLS or API keys – monitor unusual tool sequences 4. Disable MCP entirely as it cannot be secured Correct! Why: The article recommends hosting MCP servers internally and authenticating calls via mTLS or API keys and monitoring for unusual tool sequences. Context: Local MCP servers have file system access to the host machine making careful implementation review essential. Remember: Internal hosting – strong auth – watch for anomalies. 2 / 7 2. According to the article – what approach is better for plugin security? 1. Fewer plugins with tight permissions rather than many plugins with broad access 2. Many plugins with broad access for maximum functionality 3. Only plugins that require administrator approval 4. Equal numbers of plugins regardless of permissions Correct! Why: The article states that fewer plugins with tight permissions is better security than many plugins with broad access. Context: Each unnecessary plugin or permission is potential exposure – enabling all plugins for convenience means maximum attack surface. Remember: Less is more for plugin security. 3 / 7 3. What are the four defensive layers for plugin security described in the article? 1. Prevention – detection – response – recovery 2. Firewall – antivirus – encryption – backup 3. Vetting and approval – least privilege – sandboxing and isolation – monitoring and auditing 4. Authentication – authorization – accounting – auditing Correct! Why: The article describes vetting and approval followed by least privilege followed by sandboxing and isolation followed by monitoring and auditing as the four layers. Context: These layers work together to prevent bad plugins from entering and contain damage when things go wrong. Remember: Vet – Limit – Contain – Watch. 4 / 7 4. What is OWASP LLM #7 and why does it exist? 1. An encryption protocol for plugin communications 2. Insecure Plugin Design – exists because plugin security is systematically weak across the industry 3. A specific type of malware that targets AI systems 4. A certification standard for secure plugin development Correct! Why: OWASP LLM #7 addresses Insecure Plugin Design – it exists because plugin security is systematically weak across the industry. Context: Plugins often receive excessive permissions and lack input validation because they are built quickly with security as secondary. Remember: Assume plugins are insecure until proven otherwise. 5 / 7 5. What is typosquatting in the context of plugin security? 1. Typing commands incorrectly into the AI system 2. Creating plugins with names similar to popular ones hoping users install the wrong one 3. Encrypting plugin communications with weak algorithms 4. Using keyboard shortcuts to bypass security Correct! Why: Typosquatting creates plugins with names similar to popular legitimate plugins hoping users install the wrong one – for example gcal-assistant vs gcal-asst. Context: This is a supply chain attack targeting plugin marketplaces by exploiting user typing errors. Remember: Wrong name – wrong plugin – real attack. 6 / 7 6. What makes AI plugin security fundamentally different from traditional integrations? 1. The AI makes decisions about which plugins to call rather than humans explicitly choosing actions 2. Traditional integrations cannot connect to external systems 3. Traditional integrations are always less secure than AI plugins 4. AI plugins require more bandwidth than traditional integrations Correct! Why: With AI plugins the AI chooses which actions to take rather than humans explicitly choosing – and the AI can be manipulated through prompt injection. Context: This decision flow creates unique risk because attackers can influence the AI interpretation to trigger unintended plugin actions. Remember: The AI decides – and the AI can be manipulated. 7 / 7 7. According to the article – what analogy best describes the security risk of AI plugins? 1. Creating backup copies of important documents 2. Installing antivirus software on multiple computers 3. Giving your AI keys to different rooms in your building – each key could be misused 4. Building a firewall around your network perimeter Correct! Why: The article describes plugins as giving your AI assistant keys to different rooms in your building – each key could be misused. Context: This analogy illustrates that every plugin grants access to systems and data that could be exploited if the AI is manipulated or the plugin is malicious. Remember: Every plugin is a key that could end up in the wrong hands. Your score isThe average score is 0% Restart quiz Download PDF Please leave this field empty🔐 The AI Security Manager's Newsletter Weekly insights on AI risk management, EU AI Act compliance, and practical security strategies. We don’t spam! Read our privacy policy for more info. Thank you! Please check your inbox to confirm your subscription.
