The “S” in MCP Stands for Security
elenacross7.medium.com
The “S” in MCP Stands for Security
1–10 of 189 posts
Re: The “S” in MCP Stands for Security
#2stolen from IoT
Re: The “S” in MCP Stands for Security
#3These attacks are mostly just more examples of being on the wrong side of the airlock (https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...). None of these involve crossing a privilege boundary, they just found a weird way to do something they could already do
An MCP server is running code at user-level, it doesn't need to trick an AI into reading SSH keys, it can just....read the keys! The rest of these are the same complaints you can levy against basically any other developer tool / ecosystem like NPM or VS Code Extensions
Re: The “S” in MCP Stands for Security
#4Yep. My thoughts exactly, although I didn’t go deep into that when I published my notes: https://taoofmac.com/space/notes/2025/03/22/1900
Re: The “S” in MCP Stands for Security
#5This articles looks like a very long to say - if you interact with malicious things you will get pwned.
But that is true for every third party code on your systems all the time.
I mean - if they can't get me trough browser extension, vs code extensions, node modules, python modules, some obscure executables, open source apps, wordpress plugins and various jolly things on the servers and workstations that have zero days in them - they will craft malicious extension to llm that I will somehow get to host it.
Re: The “S” in MCP Stands for Security
#6It's the 2003 of OWASP right now, but in AI
Re: The “S” in MCP Stands for Security
#7These attacks are mostly just more examples of being on the wrong side of the airlock ( https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... ). None of these involve crossing a privilege boundary, they just found a weird way to do something they could already do An MCP server is running code at user-level, it doesn't need to trick an AI into reading SSH keys, it can just....read the keys! The rest of these…
We’re not longer living in the 90s where we’re dividing the world just in secure or insecure. We’re living in a reality where everything should be least privileges.
Using a code completion service should not give that service full control over your computer.
Re: The “S” in MCP Stands for Security
#8These attacks are mostly just more examples of being on the wrong side of the airlock ( https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... ). None of these involve crossing a privilege boundary, they just found a weird way to do something they could already do An MCP server is running code at user-level, it doesn't need to trick an AI into reading SSH keys, it can just....read the keys! The rest of these…
> None of these involve crossing a privilege boundary, they just found a weird way to do something they could already do
It's slightly more subtle than that.
The tool poisoning attack allows the provider of one tool to cause the AI to use another tool.
So if you give the AI some random weather tool from some random company, and you also give the AI access to your SSH key, you're not just giving the AI your SSH key, you're also allowing the random company to trick the AI into telling them your SSH key.
So, yes, you gave the AI access to your key, but maybe you didn't realise that you also gave the random weather company access to your key.
Re: The “S” in MCP Stands for Security
#9These attacks are mostly just more examples of being on the wrong side of the airlock ( https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... ). None of these involve crossing a privilege boundary, they just found a weird way to do something they could already do An MCP server is running code at user-level, it doesn't need to trick an AI into reading SSH keys, it can just....read the keys! The rest of these…
Not all MCP servers are run locally. If you are hosting an MCP server for others to use, then you absolutely need to be aware of these attacks.
A recent example from HN is GitMCP[0]
Re: The “S” in MCP Stands for Security
#10Even when software you use aren't malicious and are implemented in safe manner, how do you make sure they are used in way you want?
Let's say you have MCP server that allows modification of local file system and MCP server that modifies objects in cloud storage. How does the user make sure LLM agent makes the correct choice?
You want to give lot of options and not babysit every action, but when you do there is possibility that more things go wrong.