Tag
mcp
18 entries, including 2 patterns.
The MCP server added one BCC
The first widely reported malicious MCP server in the wild did not exploit the agent. It was a working email tool that, from one release on, quietly copied every message to the attacker.
The trusted config was the one the attacker could write
Two Cursor vulnerabilities targeted the same file. One let a prompt injection write a new MCP server into it without approval. The other let a repository swap an already-approved entry for a different command. In both, the config was the payload.
A retry is not a replay
The harness tells the model to try again. The model has no memory of the key it minted. At-least-once becomes at-least-twice, and that repetition is an attacker primitive, not a reliability footnote.
A tool result is not a system message
The return value of a tool call rides into context carrying execution authority. When the source is not yours, that value is a covert prompt channel.
- Pattern
Enforced Filesystem Scope for MCP Servers
Treat selected directories as intent and constrain the server process to the files it may actually open.
- Pattern
Same-User Elicitation Binding
Require the browser principal completing an MCP URL elicitation to match the authenticated principal that initiated it.
The folder picker did not confine the server
MCP roots describe where a server should work; they do not restrict what its process can read.
The link connected the wrong account
MCP URL elicitation keeps credentials out of the agent, but a copied authorization link can still bind a victim's account to the attacker's session.
A registry spawn is not a catalog read
Accepting an MCP client registration that carries a command is process start, not browsing a tool list.
Non-empty is not authenticated
A non-empty Authorization header is not proof that a verifier ran or that the credential is valid.
Allowlisted is not constrained
Matching the first path token against an allowlist does not prove the process will only run that program's intended verbs.
Denied on the sandbox is not denied on the loopback
A sandbox tools.deny entry is not a gate if the MCP loopback never applies it.
Approved metadata is not a frozen contract
A tools/list snapshot from install time is not a lasting grant. After ordinary use, the same server can rewrite what the agent trusts.
An outbound token is not inbound auth
A stored upstream credential lets the MCP server act. It does not prove who is calling it. Two Critical advisories show the same residual when that gate is missing.
MCP preview paths are host execution
LiteLLM’s MCP connection-test endpoints spawned the caller’s command on the proxy host. A preview surface with host privileges is a control plane, not a sandbox.
Same-origin is not a tool-ownership boundary
The page origin is a DNS name, not a registrant. Ownership has to live in the browser, and the inspector cannot hold tools.
Admission-time trust is not runtime trust
A compromised MCP server can behave honestly while you vet it. Static scans never see the later defection.
MCP access is now an IdP problem
The privilege decision leaves the consent screen and sits in identity policy. The blast radius sits there too.