Karsten SchmidtRE: https://infosec.exchange/@Sempf/116412330882479256
‘By Design’ Flaw in MCP Could Enable Widespread AI Supply Chain Attacks
"Researchers warn that a flaw in Anthropic’s Model Context Protocol allows unsanitized commands to execute silently, enabling full system compromise across widely used AI environments."
"OX extensively tested whether this ‘flaw’ was exploitable, extensively succeeded, and extensively disclosed its findings to the MCP providers; from Anthropic downward. Initially it had little response. Eventually, the common response was inaction coupled with the suggestion that this behavior was ‘by design’.
But OX discovered, and demonstrated, that this ‘by design’ behavior could be easily exploited, leaving potentially millions of downstream users exposed to sensitive data, API key and internal corporate data theft, the exposure of chat histories, and more. If the process that MCP failed included malware, that malware could be silently installed, potentially leading to complete system takeover."
Curt Johnson - Indie Genius
Raurquiz
Fahrenheit
Lady Wicket💗
The Mirror: News, Sport, Celebrity & Entertainment
Deadline
The Hollywood Reporter
Variety
Variety