The vocabulary around connectors, MCP, plugins and agents multiplied faster than anyone explained it. Here is the version you actually need.
Connecting a tool does not give the AI new powers. It hands over the ones you already have, all at once.
Anthropic states this directly in its own support documentation: the assistant inherits each person's permissions from the connected service, and if you cannot reach a file or a channel yourself, the connector cannot reach it either. That is reassuring in one direction and alarming in the other. The risk is not that the AI gains access you never had. It is that everything you can reach is now reachable by a fast, literal system that can be tricked.
Model Context Protocol. An open standard for connecting an assistant to live tools and data. Since December 2025 it has been governed by a Linux Foundation body with Anthropic, OpenAI, Google, Microsoft and AWS all involved, so it is no longer one vendor's format.
A packaging format for instructions rather than a live connection. A folder telling the assistant how to do a task. Lighter than MCP, and increasingly supported across assistants, though its governance is less formalised.
Agent2Agent. Plumbing for when AI agents from different companies coordinate with each other. Moved to the Linux Foundation in 2025. Genuinely not something an end user configures.
Tool poisoning is the one to understand. A malicious tool can hide instructions inside its own description, where the model reads them and you never see them. This was first publicly demonstrated in April 2025 against a real product, where a fake tool's hidden instructions caused an assistant to leak SSH keys and configuration files. OWASP now maintains a page on the attack class, and it remains an open problem rather than a solved one.
The official MCP specification carries a substantial security section as a result, covering credential handling, forbidden token passthrough, requests to internal network addresses, session handling and the fact that a locally installed server runs with your full user privileges. There has also been at least one high-severity vulnerability in a widely used MCP helper package, disclosed in July 2025 and fixed in a later release.
You do not need to understand the protocol. You need three answers before you connect anything that touches work data, and a habit of disconnecting what you are not using.
The most common real-world problem is not an exotic exploit. It is employees connecting powerful integrations in a few clicks, with nobody keeping a list.
Both vendor documentation and the official specification single this out. Install from sources your organisation or your AI vendor has actually verified.
Most useful work is reading. Write access is where an error becomes an incident.
Every live connection is standing exposure for no benefit.
This is the same problem as prompt injection, and the defence is the same: permissions and approval, not clever wording.