MCP Security Vulnerabilities and Attack Vectors

Re:MCP Security Vulnerabilities and Attack Vectors by amitksingh1490 on Saturday July 19, 2025 @02:24PM (#44618023)

MCP new spec has to an extent covered auth. But the MCPs are yet to adopt to that.

[ Parent | on HN ]

Re:MCP Security Vulnerabilities and Attack Vectors by simonw on Saturday July 19, 2025 @05:25PM (#44619571)

Auth doesn't protect against confused deputy attacks, which is a common problem exposed by MCP and other LLM tool systems. https://en.m.wikipedia.org/wiki/Confused_deputy_problem

[ Parent | on HN ]

Re:MCP Security Vulnerabilities and Attack Vectors by bitweis on Saturday July 19, 2025 @05:51PM (#44619761)

100% - especially when Auth stands for just Authentication. Simple RBAC authorization also won't take us far. But Fine-grained Permissions(e.g. OPA, Cedar, OpenFGA, Permit.io) with ReBAC giving ai-agents Zero standing permissions, and only deriving on the fly the least privilege they need / got consent for, can dramatically reduce the problem

[ Parent | on HN ]