Unverified50% confidenceDecision RuleExact time
Any automated system that executes, evaluates, or loads uploaded content is running untrusted code, regardless of whether its perceived context is safe.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Claims
UnverifiedWhen an Agent processes untrusted external inputs, the input content must be filtered, secondary confirmation must be set for critical operations, and the scope of accessible data and the types of callable operations must be strictly limited.70% similarUnverifiedIf an application only listens for DELETE requests while the IdP actually sends a PATCH with active=false, deactivated users may still retain system access, posing a security risk.67% similarUnverified如果一个编程工具会在用户不知情的情况下修改发送给服务器的数据，对任何有数据合规要求的企业都是不可接受的，因为它违反了用户的知情权67% similarUnverifiedThe content of the model field in an API response payload can be filled in freely by the service provider and cannot be fully trusted; behavioral testing is a more reliable verification method.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1023282API
curl https://kongchang.com/api/v1/knowledge/claims/1023282MCP
get_claim(id=1023282)