Permission drift
When a new version of a listing quietly asks for more access than the version you approved.
You approve a set of permissions once, at install. Later versions can change that set, and in most software distribution channels nobody tells you.
On this site the manifest is pinned per version. Any change to declared tools, scopes or egress drops the listing to unverified, blocks further sales until it is re-tested, and notifies everyone who bought it.
It is the mechanism behind the most serious disclosed vulnerabilities in this category, and almost nowhere else detects it.
Auto-updating agent tooling the way you auto-update a dependency. A dependency cannot change what it is allowed to reach without you reading the diff. A manifest can.
Related terms
See Permission drift on a real listing
Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.
Open the catalogue