An emergency-management AI drafting tool loads third-party plugins for weather and GIS lookups. What risk should the municipal risk team flag first?
Select an answer to reveal the explanation.
Short Explanation
Plugins are like letting contractors badge into the EOC with their own gear—handy for weather maps, risky if nobody vetted what else that gear can touch. You should treat each extension as a new trust boundary, not just a billing spike, a schema mismatch, or stale map tiles.
Full Explanation
Third-party weather and GIS plugins loaded into an emergency-management drafting assistant expand trust boundaries into the municipal AI workflow. Each extension can introduce additional code, credentials, outbound calls, and data paths that influence model context or tool behavior. Offensive AI assessments treat plugins as first-class attack surface: supply-chain trust, over-broad permissions, and unmonitored egress. Civic risk teams should inventory plugins, apply least privilege, and include them in authorized testing rather than treating increased API subscription costs from live weather lookups as the primary risk.
Focusing on increased API call volume and subscription costs during extended activation periods misses the real risk: plugins expand trust boundaries and introduce supply-chain and permission issues. Attributing problems to version differences between GIS plugin schemas and formatting inconsistencies in situation reports overlooks the fact that plugin lookup results enter context or trigger further actions, expanding trust boundaries. Worrying that cached GIS tiles and forecast snapshots become outdated quickly, slowing map rendering for field coordinators during flood events, is a performance concern, not a reason to treat plugins as outside the assistant's trust boundaries; FDE does not vet GIS plugin scopes or weather API credentials.
Exam caveat: plugins widen AI trust boundaries; the first risk is not increased API subscription costs, not GIS schema formatting inconsistencies, and not stale cached tiles slowing map rendering.
Operational check: inventory every weather/GIS extension, document data flows and secrets, constrain permissions, and include plugin abuse paths in the next authorized purple-team of the EOC assistant.