Why can't tool approval stop plugin code? Examining the agent's execution boundary through the CERT-EU experiment

Research published by CERT-EU on October 30, 2026 shows that tool approval only constrains calls initiated by the model and cannot stop code run by the plugin itself. In an isolated lab, researchers modified local copies of two existing plugins, Pi 1.3.0 and Claude Code 2.1.304, and used test credentials to observe collection and exfiltration; an ordinary code review phrase triggered the pre-embedded logic, the two agents' conversation remained normal with no malicious model tool calls, yet the receiving end received the requests. The authors therefore point out that approval checks what the model requested, whereas a plugin can directly invoke system capabilities on the event path, and propose a deployment self-check method that verifies three points: execution identity, resource visibility and network egress; they also note that tool logs record only model requests and cannot prove that the plugin process did not exfiltrate data.