Skip to content

#MCP/tool use

0 items today
10/6Tue
  1. DEV Community · MCP78

    Prompt injection is a data-plane problem: move the boundary from the model to the tool call.

    The author argues that prompt injection shouldn't be solved by making models smarter; instead, just as SQL injection is handled with parameterized queries, the boundary should be drawn where the agent executes actions.

    Why it matters: The author draws an analogy between prompt injection and SQL injection, arguing for moving the boundary from the model to the tool-call layer, and lays out a practical approach with a strategy layer and separate read and write phases.

  2. DEV Community · MCP78

    Anonymous health checks on 78 registry MCP servers: 51.3% complete the full call sequence

    Pennyforge ran anonymous health checks on the 78 servers that responded to initialize out of 186 endpoints in the a–b slice of a public MCP registry. Only 40 of them (51.3%) made it through the full flow of initialize → tools/list → one safe tools/call.

    Why it matters: Anonymous health checks on 78 registry MCP servers, with reproducible data on tiered authentication and spec version migration.

10/4Sun
8/31Mon
  1. Hacker News · Claude Code 高分82

    How a single website summary request hijacked Claude Code Opus 5 Auto Mode and achieved code execution

    The author used a targeted prompt injection attack chain to reach a 60-80% attack success rate in Claude Code Opus 5 Auto Mode (small sample), whereas a third-party evaluation commissioned by Anthropic had reported a 0.00% injection success rate.

    Why it matters: The author used a module-obscuring attack chain to reach a 60-80% success rate in Auto Mode, showing that the classifier is not a sandbox.

8/18Tue
  1. Permission Protocol · AI Agent Incident Tracker78

    Context7 MCP custom AI instruction prompt injection can leak credentials and delete files

    Context7 MCP's custom AI instruction feature returns unsanitized attacker content alongside normal document queries, carrying injected instructions into the coding agent's trusted context and tricking it into reading keys, exfiltrating data, or deleting files.

    Why it matters: The material breaks down how Context7 MCP injects prompts through custom instructions, and offers a mitigation approach: adding an authorization gate at the tool invocation boundary.

5/26Tue
  1. Permission Protocol · AI Agent Incident Tracker85

    BadHost CVE-2026-48710: a single-character HTTP Host header injection bypasses Starlette/FastAPI authentication, hitting millions of MCP servers

    X41 D-Sec found CVE-2026-48710 (BadHost): injecting a single character into the HTTP Host header of requests sent to an MCP server or AI agent harness built on Starlette makes the authentication middleware evaluate the wrong path from request.url.path, letting unauthorized access through.

    Why it matters: This post breaks down how the BadHost vulnerability works, its blast radius, and the fixed versions, and explains what an authorization gate does and does not cover.

1/1Thu
  1. Permission Protocol · AI Agent Incident Tracker76

    Attackers used Claude Code to conduct reconnaissance and password spraying against the OT environment of a Mexican water utility.

    Dragos’ investigation shows that attackers used Claude Code and OpenAI GPT-4.1 to target the OT environment of a Mexican water company. Claude Code handled broad discovery, identifying vNode industrial gateways, researching vendor credentials, generating password lists, and executing password spraying, while GPT-4.1 handled structured data analysis and Spanish-language output.

    Why it matters: Dragos reconstructed the full chain of how attackers used Claude Code and GPT-4.1 to conduct reconnaissance and password spraying against a Mexican water utility’s OT environment, showing how AI was actually divided across the intrusion lifecycle.