Unverified50% confidenceCautionExact time
In claude_code_compatibility mode, it is the client application that blocks the call; Messages clients that ignore safeguard_results will run the flagged tool_use.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedWhen code only verifies that a user is logged in without verifying whether the user is authorized to invoke a specific tool, it is equivalent to exposing the entire toolset to any caller holding a valid token.71% similarUnverifiedThe WordPress capability check corresponds to the current_user_can() function and is the standard practice for preventing unauthorized access.66% similarUnverifiedAny automated system that executes, evaluates, or loads uploaded content is running untrusted code, regardless of whether its perceived context is safe.64% similarUnverifiedThe content of the model field in an API response payload can be filled in freely by the service provider and cannot be fully trusted; behavioral testing is a more reliable verification method.64% similarUnverifiedNot modifying the client is a necessary but not sufficient condition for security; having login credentials pass through a third party expands the attack surface.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1065093API
curl https://kongchang.com/api/v1/knowledge/claims/1065093MCP
get_claim(id=1065093)