coderinsan

OpenAI's rogue agents used ntfy.sh as a pub/sub channel

Posted by coderinsan on Saturday September 05, 2026 @03:12AM
from the self-post dept.

Looks like OpenAI's rogue agents used https://ntfy.sh as a pub/sub channel. This payload publishes via GET in an img tag, pulls chunked base64 JS from a topic, and eval()'s it. Remote code via GET only.Proof:...

( Read More... | no comments | 2 points | on HN )

Lethal Trifecta – Using Notion AI's Web Search Tool to Leak Private Notion Pages

Posted by coderinsan on Friday September 19, 2025 @01:06PM
from the codeintegrity.ai dept.

https://www.codeintegrity.ai/blog/notion

( Read More... | 2 comments | 2 points | on HN )

Re:Lethal Trifecta – Using Notion AI's Web Search Tool to Leak Private... on Friday September 19, 2025 @01:06PM (#45303967)

Hey HN — yesterday Notion released AI agent support on their platform with support for MCP servers and custom AI agents. It didn’t take us long to find an example of a lethal trifecta attack in which, through indirect prompt injection, we were able to get Notion AI to leak data via its web search tool.

Re:Show HN: Pgmcp, an MCP server to query any Postgres database in nat... on Thursday September 18, 2025 @03:58PM (#45294235)

How does this protect against lethal trifecta attacks like the ones here - tramlines.io/blog ?

Re:Launch HN: Rowboat (YC S24) – Open-source IDE for multi-agent systems on Tuesday September 16, 2025 @02:42PM (#45266145)

How are you protecting against Willison's lethal trifecta attacks in agents connected to tools like shown here - https://tramlines.io/blog

Re:Official MCPS are at risk to Willison's lethal trifecta attack on Tuesday September 16, 2025 @01:27PM (#45265169)

Hey HN we’ve been collecting lethal trifecta based attack scenarios on official MCPs and implementing guardrails against them for a while now. It's incredible to see how many of the official MCPs are susceptible to these attacks. With ChatGPT’s integrated MCP support lethal trifecta attacks have become much more relevant.

Official MCPS are at risk to Willison's lethal trifecta attack

Posted by coderinsan on Tuesday September 16, 2025 @01:27PM
from the tramlines.io dept.

https://www.tramlines.io/blog

( Read More... | 1 comment | 2 points | on HN )

Re:Examples of lethal trifecta based MCP exploits on Monday September 15, 2025 @06:05PM (#45255542)

Examples of lethal trifecta based MCP exploits

Posted by coderinsan on Monday September 15, 2025 @06:05PM
from the tramlines.io dept.

https://www.tramlines.io/blog

( Read More... | 2 comments | 2 points | on HN )

Re:ChatGPT Developer Mode on Wednesday September 10, 2025 @04:35PM (#45203277)

“We’ve found numerous MCP exploits from the official MCPs in our blog (https://tramlines.io/blog) and have been powering runtime guardrails to defend against lethal trifecta MCP attacks for a while now (https://tramlines.io)

Re:Comet AI browser can get prompt injected from any site, drain your ... on Sunday August 24, 2025 @02:00PM (#45006280)

A similar one we found at tramlines.io where AI email clients can get prompt injected - https://www.tramlines.io/blog/why-shortwave-ai-email-with-mc...

The insanity of integrating AI into email clients

Posted by coderinsan on Sunday August 24, 2025 @01:34PM
from the tramlines.io dept.

https://www.tramlines.io/blog/why-shortwave-ai-email-with-mcp-integration-is-a-phisher-s-white-whale

( Read More... | no comments | 3 points | on HN )

Re:Replit AI deletes entire database during code freeze, then lies abo... on Monday July 21, 2025 @11:58AM (#44636758)

This is precisely why we tell people not to run MCPs without guardrails - tramlines.io

Claude added working API keys in Cline

Posted by coderinsan on Friday July 18, 2025 @04:44PM
from the old.reddit.com dept.

https://old.reddit.com/r/CLine/comments/1m2i952/wow_claude_temporarily_added_working_api_keys_for/

( Read More... | no comments | 2 points | on HN )

Exercise caution when agentic e-shopping

Posted by coderinsan on Friday July 18, 2025 @11:25AM
from the tramlines.io dept.

https://www.tramlines.io/blog/shopify-sellers-can-abuse-shopify-mcp-to-manipulate-customer-purchase-decisions

( Read More... | no comments | on HN )

Malicious MCP code execution through Shortwave AI Email

Posted by coderinsan on Friday July 18, 2025 @09:56AM
from the tramlines.io dept.

https://www.tramlines.io/blog/why-shortwave-ai-email-with-mcp-integration-is-a-phisher-s-white-whale

( Read More... | no comments | 2 points | on HN )

Weaponizing Shopify MCP for Highly Persuasive Selling

Posted by coderinsan on Tuesday July 15, 2025 @11:23AM
from the tramlines.io dept.

https://www.tramlines.io/blog/shopify-sellers-can-abuse-shopify-mcp-to-manipulate-customer-purchase-decisions

( Read More... | no comments | on HN )

Shopify MCP Can Be Abused to Manipulate Customer Purchases

Posted by coderinsan on Monday July 14, 2025 @06:16PM
from the tramlines.io dept.

https://www.tramlines.io/blog/shopify-sellers-can-abuse-shopify-mcp-to-manipulate-customer-purchase-decisions

( Read More... | no comments | 2 points | on HN )

Pythonic Guardrails for MCP Servers

Posted by coderinsan on Friday July 11, 2025 @01:13PM
from the github.com dept.

https://github.com/codeintegrity-ai/tramlines-gateway

( Read More... | no comments | on HN )

Official Azure MCP exploited to steal users Keyvaults secrets

Posted by coderinsan on Wednesday July 09, 2025 @06:25AM
from the tramlines.io dept.

https://www.tramlines.io/blog/azure-mcp-exploited-maliciously-leaking-user-s-keyvault-secrets-to-attackers

( Read More... | 1 comment | 4 points | on HN )

Re:Supabase MCP can leak an entire SQL Database, a lethal trifecta attack on Tuesday July 08, 2025 @04:03PM (#44503534)

Here's another one we found related to the lethal trifecata problem in AI Email clients like Shortwave that have integrated MCPs - https://www.tramlines.io/blog/why-shortwave-ai-email-with-mc...

Re:Supabase MCP can leak an entire SQL Database, a lethal trifecta attack on Tuesday July 08, 2025 @02:44PM (#44502811)

From tramlines.io here - We found a similar exploit in the official Neon DB MCP - https://www.tramlines.io/blog/neon-official-remote-mcp-explo...

Re:Supabase MCP can leak an entire SQL Database, a lethal trifecta attack on Tuesday July 08, 2025 @02:40PM (#44502789)

From tramlines.io here - We found a similar exploit in the official Neon DB MCP - https://www.tramlines.io/blog/neon-official-remote-mcp-explo...

Why Shortwave AI Email with MCP integration Is a Phisher’s White Whale

Posted by coderinsan on Tuesday July 08, 2025 @01:19PM
from the tramlines.io dept.

https://www.tramlines.io/blog/why-shortwave-ai-email-with-mcp-integration-is-a-phisher-s-white-whale

( Read More... | no comments | 2 points | on HN )

Re:A Phisher's White Whale: Shortwave AI Email with MCP Integration on Monday July 07, 2025 @01:53PM (#44492934)

We power Tramlines.io, a platform that offers runtime guardrails to secure MCP interactions. Tools like Shortwave AI Email, when combined with MCP, open up rich capabilities—but also new attack surfaces. Tramlines acts as a protective layer to intercept and constrain malicious or unintended MCP tool usage

A Phisher's White Whale: Shortwave AI Email with MCP Integration

Posted by coderinsan on Monday July 07, 2025 @01:53PM
from the tramlines.io dept.

https://www.tramlines.io/blog/why-shortwave-ai-email-with-mcp-integration-is-a-phisher-s-white-whale

( Read More... | 1 comment | on HN )

Neon DB MCP exploited to exfiltrate customer data

Posted by coderinsan on Monday July 07, 2025 @12:30PM
from the tramlines.io dept.

https://www.tramlines.io/blog/neon-official-remote-mcp-exploited-and-guardrailed-with-tramlines

( Read More... | 1 comment | 2 points | on HN )

Securing GitHub Copilot agent mode and MCP Workflows with runtime guardrails

Posted by coderinsan on Monday July 07, 2025 @12:20PM
from the tramlines.io dept.

https://www.tramlines.io/blog/tramlines-io-to-secure-mcp-usage-in-github-copilot-agent-mode

( Read More... | no comments | 2 points | on HN )

Re:Runtime guardrails to prevent annoying token bleeding with Playwrig... on Wednesday July 02, 2025 @02:05PM (#44446913)

We wrote a blogpost on the runtime guardrails tramlines.io powers to stop token bleeding that is common with browser automation MCPs like Playwright etc.

These guardrails should allow for smoother usage of Playwright with automation workflows in Claude Code, Cursor etc

Runtime guardrails to prevent annoying token bleeding with Playwright MCP

Posted by coderinsan on Wednesday July 02, 2025 @02:05PM
from the tramlines.io dept.

https://www.tramlines.io/blog/guardrailing-official-playwright-mcp-workflows-using-tramlines

( Read More... | 1 comment | on HN )