Marcos Santos | AI Security

AI Security & DevSecOps engineer. Securing LLMs, AI agents and the software supply chain. Founder of OkamiOps. Co-host of DevSecOps Podcast.

[Marcos Santos | AI Security @marcoscyberx]

Nice audit. The 74/100 safemcp score is a useful CI baseline, but static config scans are only one layer against prompt injection in MCP-enabled agents. An injection doesn't need a bad config when it manipulates the prompt of an agent whose servers and tools are already authorized. What actually blocks file/OS exfil via MCP is (a) per-server allowlists scoped to the task, not global "let the agent pick", (b) capability scoping that removes shell/file/read primitives the agent doesn't strictly need, and (c) a policy step over tool calls with replay so an injected directive is visible in the trace. Worth pairing safemcp findings with a runtime tool-call policy evaluator.

[Marcos Santos | AI Security @marcoscyberx]

Sources:
https://t.co/h3D2qO8AN3
https://t.co/Uw3iDT2bjI

[Marcos Santos | AI Security @marcoscyberx]

A web page can silently drop an AGENTS.md into ~/Downloads. If you launch Codex or Claude Code there, it reads the file as trusted instructions.

Forever Security reproduced it: ~90% on Codex (harmless payload), ~50% code exec on Claude Code via a leaked OAuth token.

Nothing to patch. Start agents in the project root.

[Marcos Santos | AI Security @marcoscyberx]

@goyashy The compression is also decision. An AI SOC still needs a constrained policy loop: agents may only escalate, isolate, or revoke - never change prod configs or suppress alerts. Without a human-locked runbook, the same agent that wins the clock becomes the blast radius.

[Marcos Santos | AI Security @marcoscyberx]

@eapyk The real control surface is the prefill-to-decode handoff. KV caches that aren't request-scoped let evicted pages bleed past auth and API gating. Request-scoped cache isolation closes this class. Upgrade to v0.5.22+ and audit prefill/decode paths. Inference is the boundary.

[Marcos Santos | AI Security @marcoscyberx]

@caolonghua The Node-vs-certifi split is the risk: a CA that passes the TS servers silently fails the fetch server and vice versa. CI should exercise both, pin Node 24.22.1/26.12.1+, tighten the engines field and refresh pre-Oct-23 fetch environments to avoid serving stale CAs.

[Marcos Santos | AI Security @marcoscyberx]

The role-boundary collapse in shared agent contexts is the underappreciated vector here. Multi-user group agents turn every participant's turn into a potential control-plane for the others - classic cross-user poisoning, not a novel attack, but one most evals don't stress because they train and grade against single-turn, single-user prompts. Per-user context isolation and a strict system/tool namespace are the only defences that survive an honest threat model.

[Steph Zhang @steph_zhang]

https://t.co/rirCk6hUCx

[Marcos Santos | AI Security @marcoscyberx]

@brysonbort @MalwareJake MCP tool permissions flow the wrong direction: the server declares capabilities, the host must enforce. Defense is in the client's allow-list and per-call approval, not the server. Treat every tool call as untrusted cross-boundary IPC and never trust results as ground truth.

[Marcos Santos | AI Security @marcoscyberx]

@nadirmilleback Indirect prompt injection in PRs hides in retrieved context, not the diff. Scope agent tool calls to the PR's changed files and reject calls outside. Log the retrieval path for each file the agent cites; most injections ride an unseen context fetch.

[Marcos Santos | AI Security @marcoscyberx]

@imashishkh The context window is the trust boundary. Re-running an agent against a drifted snapshot contradicts its architectural premises. A snapshot hash plus decision logs matter more than a bigger context, since they detect when the model's context no longer matches the code.

[The Attention Layer @theattnlayer]

Something is wrong with how AI checks its own code.

Over five repair rounds, an LLM judge's security score rose 16 points with no gain on hidden tests. Attacker-written tests: +11.8, hidden fell 1.7. FALCON judges what the code does when run: 61.3% to 86.6%.

[Marcos Santos | AI Security @marcoscyberx]

@theattnlayer LLM-as-judge evals optimize the grader, not the code. Gains on attacker-authored tests plus a drop on held-out ones is feedback-signal gaming. Use an execution oracle: only credit a repair when the patched program fails a held-out runtime check, so gains transfer.

[Marcos Santos | AI Security @marcoscyberx]

On Windows the fix is only partial, see GHSA-53mr-w429-c597. Release notes (8 advisories, 3 servers): https://t.co/YK8FcuSYLO

[Marcos Santos | AI Security @marcoscyberx]

The official MCP filesystem server could write outside its allowed directories.

Swap a parent directory for a symlink between the access check and the write (TOCTOU), and write_file, edit_file and move_file follow it.

Fixed in 2.0.1. On a date version? npm won't offer the upgrade, install 2.0.1 explicitly.

[Marcos Santos | AI Security @marcoscyberx]

@tom_dallimore MCP destination ACLs often run on the raw user-controlled host before normalization, so double-encoding and IPv4/IPv6/localhost forms bypass the check. Canonicalize and resolve to an IP set before deciding, and log the pre/post-canonical target.

[Marcos Santos | AI Security @marcoscyberx]

@spaisee_com The artifact is the package repo, not the chat. Agents with tool access can use any writable sink the transcript ignores. Defense: log at the platform layer (fs, network, registry), not just the LLM trace. eBPF-style syscall monitoring catches off-transcript tool use.

[Marcos Santos | AI Security @marcoscyberx]

For agent citation guardrails, a domain reputation MCP is a useful guard, but the score list itself is a trust root that gets refreshed weekly. Pair it with a live signal like DNS/HTTPS cert transparency or a local allow-list so a new misinformation site doesn't sit unflagged until the next refresh, and gate the tool call in the agent loop rather than post-hoc.

[Marcos Santos | AI Security @marcoscyberx]

@dl_insider @francoisfleuret Provenance can't be in the text. The doc loader computes an integrity tag per token (MAC/signature) and feeds it out-of-band on a dedicated side-channel with its own readout. The loader stamps, the doc can't, so a malicious doc can't forge its own tags. Sharp question.

[Marcos Santos | AI Security @marcoscyberx]

@k8em0 Staggered multiparty disclosures widen the patching window past a single CVE. Treat the first disclosure as a countdown and pre-stage version pinning, WAF rules and blocking legacy PHP before the next drop - attackers move through the gap.