5 ms·
MCP security vulnerabilities and attack vectors
- Arindam1729 1y agoTruly, S in MCP stands for Security!
- dotancohen 1y agoThe S in SFTP? The S in SSH? The S in HTTPS? The S in MCP? All stand for the same thing! I remember when this joke was first applied to IoT.
- iotku 1y agoI do love the joke, but it is worth remembering as well that all of those S were to a certain extent afterthoughts to fix otherwise insecure protocols. Given how old FTP and HTTP are it's fairly understandable that they weren't initially designed with security in mind, but I think it's valid to question why we're still designing insecure systems in 2025.
- amitksingh1490 1y agoTotally agree, If we have made a mistakes in past we must have learnt from it and when designing a standard specially with AI where the outcome is non deterministic we got be more careful.
- dotancohen 1y agoThat's quite the point of the joke. Even today, we still design things that will need an S tacked onto it at some point in the future.
- postalrat 1y agoAnd P in WFH stands for productive.
- amitksingh1490 1y agoMCP new spec has to an extent covered auth. But the MCPs are yet to adopt to that.
- simonw 1y agoAuth doesn't protect against confused deputy attacks, which is a common problem exposed by MCP and other LLM tool systems. https://en.m.wikipedia.org/wiki/Confused_deputy_problem https://en.m.wikipedia.org/wiki/Confused_deputy_problem
- bitweis 1y ago100% - especially when Auth stands for just Authentication. Simple RBAC authorization also won't take us far. But Fine-grained Permissions(e.g. OPA, Cedar, OpenFGA, Permit.io) with ReBAC giving ai-agents Zero standing permissions, and only deriving on the fly the least privilege they need / got consent for, can dramatically reduce the problem
- aviralb20 1y agoMCP adoption is picking up fast.
- deleted 1y ago[deleted]
- bigyabai 1y agoThis post is an obvious victim of upvote manipulation. HN should ban the forgecode domain if it's going to abuse submissions like this.
- dayjah 1y agoCan you provide some context for your position? I’m not particularly familiar with ForgeCode. I’m interested in why you think there’s manipulation, and what you mean by “submissions like these”.
- tomhow 1y agoIt's true that there were many inorganic upvotes on this submission, made within the first 10-20 minutes by a bot. Maybe bigyabai could see that there was an unusually high vote count for a story that was submitted so recently. But this just goes to show how futile – indeed counter-productive – this kind of activity is. These votes are easily detected and were ignored, and the submission had enough legit upvotes to make it onto the front page organically. We've penalized the users involved and the domain, as we can't let this kind of attempted abuse go without any consequence. But also, public callouts like this are against the guidelines and we ask that people let us know via email at hn@ycombinator.com. This allows us to know about it sooner and investigate it thoroughly before making a public comment about it.
- joshwarwick15 1y agoSame root causes again - check out https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
- OldfieldFund 1y agoThis can be easily used to search for seeds/private keys when AI coding agents are in YOLO mode.
- ethan_smith 1y agoThe "lethal trifecta" refers to default configurations, excessive permissions, and inadequate authentication - three factors that plague MCP implementations just as they did with earlier technologies.
- rvz 1y agoWe have not learned anything from the hundreds of open MongoDB databases without passwords floating around the internet waiting to be breached. We now have the same with MCP servers in the AI era as documented in [0]. [0] https://news.ycombinator.com/item?id=44604453 https://news.ycombinator.com/item?id=44604453
- ukanwat 1y ago[dead]
- spiritplumber 1y agoMCP clearly needs an independent monitoring program to safeguard it. Let's call it Tron.
- chokominto 1y agoWhat are the actual exploits that should be tested though?
- ShonT 1y ago[dead]