4 ms·
Can you elaborate on "bad token scoping"? I don't think your XY phrasing fully describes the GitHub MCP exploit and curious if you think that's somehow a "toke
by wild_egg 1y ago
Can you elaborate on "bad token scoping"?
I don't think your XY phrasing fully describes the GitHub MCP exploit and curious if you think that's somehow a "token scoping" issue.
- fkyoureadthedoc 1y agoI'm unaware of the GitHub MCP "exploit", but given the overall state of LLM/MCP security FUD, there's probably some self promotion blog post from a security company about an LLM doing something stupid with GitHub data that the owner of the LLM using system didn't intend. For example, let's say I create an application that lets you chat with my open source repo. I set up my LLM with a GitHub tool. I don't want to think about oauth and getting a token from the end user, so I give it a PAT that I generated from my account. I'm even more lazy so I just used a PAT I already had laying around, and it unfortunately had read/write access to SSH keys. The user can add their ssh key to my account and do malicious things. Oh no, MCP is super vulnerable, please buy my LLM security product. If you give the LLM a tool, and you give the LLM input from a user, the user has access to that tool. That shrimple.
- wild_egg 1y agohttps://news.ycombinator.com/item?id=44097390 https://news.ycombinator.com/item?id=44097390 Also currently on the front page. It's mainly that this tool hits the trifecta of having privileged access, untrusted inputs, and ability to exfiltrate. Most tools only do 1-2 of those so attacks need to be more sophisticated to coordinate that.