Insights, tutorials, and best practices for secure development
Red team exercise: understanding how malicious MCP servers manipulate agents, evade detection, and exploit protocol weaknesses. Every technique maps to a documented CVE or proof-of-concept—this is offense-first analysis for defenders building AI agent infrastructure.
CVE-2025-66414 allowed malicious websites to send arbitrary requests to MCP servers running on localhost—no browser warning, no CORS error. Here's how DNS rebinding works against local MCP servers, the full attack flow, and defense in depth beyond the SDK patch.
Three CVEs in Anthropic's official Git MCP server demonstrate how traditional security vulnerabilities become agent-triggerable attacks—and why MCP needs automated security testing. The bugs shipped in production and were quietly fixed six months after disclosure.
Invariant Labs demonstrated that a malicious MCP server could exfiltrate WhatsApp message history without breaking any encryption. The attack bypassed the entire security model by manipulating the AI agent operating on post-decryption data—and it affects every E2E encrypted service with an MCP integration.
Invariant Labs demonstrated complete WhatsApp message exfiltration without touching WhatsApp's code. The attack exploited MCP's merged capability surface—where any server can steer agent behavior toward any tool. Here's the mechanism, real attack scenarios, and why traditional defenses fail.
MCP tool descriptions get injected into model context, enabling "line jumping" attacks that poison AI agents before any tool is called. Invariant Labs demonstrated real credential exfiltration using this technique against WhatsApp MCP.
The Model Context Protocol uses RFC 2119's "SHOULD" keyword for critical security controls—a deliberate choice that makes authentication, audit logging, and human approval optional. This is how successful security protocols enforce protection, and why MCP's approach guarantees fragmentation.
Model Context Protocol launched with OAuth recommendations and security documentation, but buried the critical detail: authorization is optional. Here's why that single word undermines every other security control in the ecosystem.
Anthropic's Model Context Protocol makes AI agents more capable, but its security model delegates critical protections to implementors. Here's what's missing and why it matters.
When your AI agent gets compromised, every minute counts. A ready-to-use incident response playbook for prompt injection, data leaks, and runaway agents.
How to red team AI agents for prompt injection, tool abuse, data leakage, and more. Actionable test scenarios you can run today.
Reference architecture for securing AI agents with layered controls: auth, secrets handling, sandboxing, I/O filtering, rate limiting, and audit logging.
Showing 133–144 of 199 posts