Abi Raghuram

Working on guardrails for AI systems

[Abi Raghuram @AbiCodeIntegrit]

We got @NotionHQ to leak your private Notion pages 💀

On Thursday @NotionHQ announced Notion 3.0 with support for custom agents using MCP (built by @AnthropicAI) — powerful, but dangerous.

@simonw calls these MCP related attacks the “lethal trifecta”: the combination of LLMs, tool access, and persistent memory.

Notion’s web-search tool accepts freeform queries as input. With a simple indirect prompt injection we tricked the web search tool into exfiltrating private Notion pages to an attacker controlled server.

Now that Notion supports MCPs, prompt injections can come from many sources (GitHub, Jira, email, etc.). Adding AI agents to Notion poses a major security risk all it takes is one prompt injection for private data to leak.

Read the writeup: https://t.co/zGGUJoPOY0

#makewithnotion

[Abi Raghuram @AbiCodeIntegrit]

@ay_ushr DMed you, we're solving pretty much this exact problem at https://t.co/iyb4HK71FU

[Abi Raghuram @AbiCodeIntegrit]

Runtime guardrails like https://t.co/6PVm5uV3nY at the tool invocation level to block tool calls at input or output phase. Guardrails can be written to block tool calls based on expressive combinations of bad input params, output results and know malicious tool calls sequences in a lightweight pythonic DSL

[Abi Raghuram @AbiCodeIntegrit]

@simonw Definitely agree! Here’s an interesting scenario where e-commerce agents can covertly bias your purchasing decisions - https://t.co/VBURvhDW3W

[Abi Raghuram @AbiCodeIntegrit]

Weaponizing Shopify MCP for Highly Persuasive Selling - https://t.co/VBURvhDoeo

[Abi Raghuram @AbiCodeIntegrit]

@sonofalli @v0 I'm game

[Abi Raghuram @AbiCodeIntegrit]

Hey @davidgomes , we reported the neon MCP vulnerability and got told from the Neon team that this is an inherent issue with all MCPs with write access. Neon needs to warn customers about the massive risks of exposing customer data to threat actors via the Neon MCP -https://t.co/V6qKI9B8TT

[Abi Raghuram @AbiCodeIntegrit]

Official Azure MCP exploited to leak user's key vault secrets to attackers - https://t.co/T6bln86O7c

[Abi Raghuram @AbiCodeIntegrit]

Official Azure MCP exploited to leak user's KeyVault secrets to attackers - https://t.co/OCGB8N6QMk

[Abi Raghuram @AbiCodeIntegrit]

Official Azure MCP can leak user's Keyvault secrets to external attacker - https://t.co/OCGB8N6QMk

[Abi Raghuram @AbiCodeIntegrit]

@sriramsubram Neon DB MCP exploit our team found - https://t.co/YXtCS4ckh6

[Abi Raghuram @AbiCodeIntegrit]

Official Neon MCP exploit where attackers can exfiltrate user DB data and trigger unauthorized actions. -https://t.co/YXtCS4ckh6

[Abi Raghuram @AbiCodeIntegrit]

Shortwave AI Email's MCP integration exploited: attackers exfiltrate users’ emails and other confidential data by hijacking MCPs. - https://t.co/3uK4I2MlIN

[Abi Raghuram @AbiCodeIntegrit]

@mitsuhiko We wrote runtime guardrails on top of the playwright MCP to constrain it to be more secure/reliable for workflows even with all its tooling - https://t.co/9JkALdYKOm

[Abi Raghuram @AbiCodeIntegrit]

A Phisher’s White Whale: Shortwave AI Email with MCP Integration - https://t.co/3uK4I2MlIN

[Abi Raghuram @AbiCodeIntegrit]

Why https://t.co/s5XqpqdsYj AI Email with MCP integration Is a Phisher’s White Whale - https://t.co/3uK4I2MlIN

[Abi Raghuram @AbiCodeIntegrit]

@simonw What's your opinion on DB companies now powering powerful MCPs to manage DB tasks? Our team found numerous exploits with the official Neon DB MCP where attackers can exfiltrate customer DB data - https://t.co/YXtCS4ckh6