News for hackers. Stuff that matters.

A comment on MCP Security Vulnerabilities and Attack Vectors. Parent comment

Re:MCP Security Vulnerabilities and Attack Vectors by simonw on Saturday July 19, 2025 @05:25PM (#44619571)
Auth doesn't protect against confused deputy attacks, which is a common problem exposed by MCP and other LLM tool systems. https://en.m.wikipedia.org/wiki/Confused_deputy_problem
[ Parent | on HN ]
Re:MCP Security Vulnerabilities and Attack Vectors by bitweis on Saturday July 19, 2025 @05:51PM (#44619761)
100% - especially when Auth stands for just Authentication. Simple RBAC authorization also won't take us far. But Fine-grained Permissions(e.g. OPA, Cedar, OpenFGA, Permit.io) with ReBAC giving ai-agents Zero standing permissions, and only deriving on the fly the least privilege they need / got consent for, can dramatically reduce the problem
[ Parent | on HN ]