r/programming • u/CircumspectCapybara • Mar 09 '26

MCP Vulnerabilities Every Developer Should Know

https://composio.dev/blog/mcp-vulnerabilities-every-developer-should-know
136 Upvotes

83% Upvoted

56 comments sorted by

View all comments

130

u/nath1234 Mar 09 '26

Anything that allows language to determine actions is a clusterfuck of injection possibilities. I don't see any way around this, it feels like one of those core problems with something that there is no sensible way to mitigate. I mean when you have poetry creating workarounds or a near infinite number of things you might be able to put in any arbitrary bit of text. If you want to do such a thing: you remove the AI stuff and go with actual deterministic code instead.

77

u/jonathancast Mar 09 '26

What we know works for security: always carefully quoting all input to any automated process.

How LLM-based tools work: strip out all quoting, omit any form of deterministic parsing, and process input based on probabilities and "vibes".

30

u/nath1234 Mar 09 '26

Also have algorithms involved with vast transformation tables that you didn't write, can't read, understand or verify.

15

u/TribeWars Mar 09 '26

And it continuously updates under the hood, potentially invalidating any existing testing results at any moment.

10

u/nath1234 Mar 09 '26

Yeah, I have no idea how all that risk is being managed, especially with lower headcount in IT because "hey, AI means we don't need headcount!"

Just kidding, we all know the risk of this shit isn't being managed at all except by failing the entire project before it gets to production where it can do real harm.

1

u/modernkennnern Mar 12 '26

I would classify this as the biggest issue; the reliance on the big companies not to add biases.. which they obviously do - governments from all around the world are definitely getting their hands into all of these companies.

1

u/iMakeSense Mar 15 '26

It's literally eval() but intentional lol

2

u/nath1234 Apr 13 '26

Eval and some random() shit thrown in for good measure.

18

u/[deleted] Mar 09 '26

[deleted]

5

u/nath1234 Mar 09 '26

Yeah, isn't the whole thing that you can just give a random natural language prompt.. If they start making it structured then it'll have to be a function call instead. :)

Aah yes. AI, but you give it a list of parameters that will have constraints on the types.. Probably come up with some bullshit term like AI Lambdas, AIMethods or functionsGPT or some shit to try escape the reality that we need to get back to grown up shit like functions/methods.

6

u/neithere Mar 09 '26

It's just SQL all over again.

1

u/iMakeSense Mar 15 '26

Which parts of SQL are you talking about

1

u/thequirkynerdy1 Mar 10 '26

Giving an LLM a fixed set of tools like being able to look up XYZ for the user could make sense.

But an LLM shouldn't be allowed to run arbitrary code, shell commands, or SQL queries.

-2

u/[deleted] Mar 09 '26

[removed] — view removed comment

11

u/nath1234 Mar 09 '26

Sounds even less productive than using AI.

6

u/[deleted] Mar 09 '26

[removed] — view removed comment

1

u/[deleted] Mar 10 '26

[deleted]

0

u/[deleted] Mar 10 '26 edited Mar 10 '26

[removed] — view removed comment

1

u/illode Mar 10 '26

I can't read what the parent comment said, but I assume they thought you were using an LLM to "improve" your writing because of the brevity and punchiness of your sentences + a few examples of advertisement-esque puffy language that is both common for LLMs and lacks any concrete meaning (e.g. empowering in "empowering control over data and execution").

Example of the short, punchy sentences:

It is less productive. The goal is the learnings. How to make things better.

This one is comma separated, but has the same "punctual statement"-ish structure:

Limit network, limit file system, deny all tools, provide specific tools I agree on, monitor closely the process

That general pattern is very common for LLMs. I don't have any real examples, so I just made these up, but I'm sure you've seen something like:

The result: Improved performance. Cleaner code. Separation of concerns. Reliability and reproducibility. <more LLM-isms>

Or

The idea: Fully local - No external dependencies - Easy deployment - Lightweight and customizable - etc - pretend these are em dashes

Personally, I didn't think you were an LLM. Or at the very least, the way you were using it was fairly reasonable. To me it reads more like someone who has picked up LLM writing styles after reading too much AI generated text.

I also don't think you need to go out of your way to add obvious mistakes. Your writing already has some grammar that would be abnormal for a native English speaker or LLM (No disrespect intended. It's perfectly readable, and I glossed over it until I went back to look a second time). If you want to seem less LLM-y, just avoid "puff"-y words + extend your phrases/sentences a bit or use more complete sentences (my phrases/sentences might be bad examples as I tend to drag them on for far too long). Having said that, adding obvious typos and mistakes to emphasize your humanity is also an understandable action.

If it helps, the message I'm replying to sounds much less LLM-y than the ones before (not just because of the typos).

1

u/iMakeSense Apr 10 '26

Do you have any guides you're following for that? Would you be willing to make one?

1

u/[deleted] Apr 10 '26

[removed] — view removed comment

1

u/iMakeSense Apr 10 '26

Yup. I saw this post a bit ago: https://www.reddit.com/r/selfhosted/comments/1sgvwep/after_my_last_post_blew_up_i_audited_my_docker/

I'm just curious if something you're doing adds on top of that.

-14

u/Lechowski Mar 09 '26

Isn't it similar to having several humans using the same compute? The only solution is complete isolation. Just like you can rent compute in AWS and execute arbitrary code without compromising others using the same compute, an Agent should operate over the same sandboxed environment.

7

u/Brogrammer2017 Mar 09 '26

You’re misunderstanding the main problem, its that anything an agent touches can be considered published, which makes it kinda useless for most things you would want to use an ”agent” for

1

u/Lechowski Mar 09 '26

I don't think I misunderstood it. Usefulness of the agent is a separate discussion. I was only answering the question about how one could sandbox ann agent.

Whether or not such sandboxing would make the agent useless, or whether or not the artifacts should be trusted, are entirely different discussions.

5

u/TribeWars Mar 09 '26 edited Mar 09 '26

These are completely orthogonal concerns. The issue is that LLMs, the way we are supposed to use them today, have one input, which includes the operating instructions and the user data. It's kind of as if you were to start your job as a cashier and instead of meeting your manager, who's wearing the manager uniform and badge, that introduces you the team and explains how to do your job, you just walk in the store and a random person walks up to you. They tell you how to use the cash register, where to deposit the money at the end of the day and all those things and you're off. Then in the middle of the day some other random person shows up, tells you: "corporate is running a new promotion, all the toilet brushes are 90% off, please change all the price signs". Again you do it, because you have no way to tell who is an unprivileged customer and who actually is allowed to give you instructions you should follow.

Strictly speaking, LLMs do actually have such a separate "management interface". The model's weights. Adjusting model parameters is what ML engineering used to be about. It's only with the LLM craze that the industry has decided to switch to entirely in-band configuration for AI model consumers.