4 ms·
So if you call a malicious MCP tool, bad things happen? Is that particularly novel or surprising?
by noident 1y ago
So if you call a malicious MCP tool, bad things happen? Is that particularly novel or surprising?
- acdha 1y agoNovel, no, but we’ve seen this cycle so many times before where people get caught up in the new, cool shiny thing and don’t think about security until abuse starts getting widespread. These days it’s both better in the sense that the security industry is more mature and worse in that cryptocurrency has made the attackers far more mature as well by giving them orders of magnitude more funding.
- NeutralCrane 1y agoWith MCP the paradigm seems to not be people getting overly excited and making grave security errors, and is rather people getting overly pessimistic and portraying malicious and negligent uses that apply broadly as if it makes MCP uniquely dangerous.
- acdha 1y agoMCP is somewhat unusually dangerous in the sense that prompt injection is an unsolved problem, but in general the tone I’ve seen has felt more like a reminder not to get so caught up in the race that you forget security.
- sumedh 1y agoMost users are not aware that its malicious.
- th0ma5 1y agoSo long as the control messages and the processed results are the same channel, they will be at an insecure standoff. This is the in-band vs. out-of-band signalling issues like old crossbar phone systems and the 2600hz tone.