Szeth

Broke web apps for 5+ years. Now I break and secure MCP servers and AI agents. Labs, write-ups and detection rules on GitHub.

[Szeth @szzeth]

7. The accountability gap here is going to get worse.
Connect an agent to an MCP-enabled platform and you're implicitly trusting that platform to enforce content integrity to the standard you'd apply to a direct operator instruction.
Almost none of them do.

[Szeth @szzeth]

Agentjacking, disclosed by Tenet Security in June.
No credential theft. No phishing. No server compromise.
Just an attacker sending a crafted error event into Sentry, which your coding agent reads through MCP and treats as instructions. 🧵

[Szeth @szzeth]

6. Plus the ones that keep proving out:
- human-in-the-loop before actions with external side effects
- least-privilege, task-scoped tokens
- red team exercises that actually include MCP injection and tool poisoning

[Szeth @szzeth]

The framing in this one is what makes it worth reading: MCP config files are supposed to be committed. The secret inside them never was.

[Help Net Security @helpnetsecurity]

Hardcoded MCP credentials found in public GitHub files - https://t.co/nrLYAU9bnV - @Hush_Security #AgenticAI #AI #Credentials #IdentityProtection #NonHumanIdentities #Cybersecurity #CybersecurityNews

[Szeth @szzeth]

@helpnetsecurity @Hush_Security The scariest number here isn't the 12%. It's that 55% of the hardcoded secrets match no vendor token format, and 31% are opaque bearer tokens for internal MCP servers.

[Szeth @szzeth]

The NSA published MCP security guidance in May and not enough people have read it.
23 discrete security issues.
Most useful part: it treats the whole agentic setup as one connected system instead of a pile of endpoints.
That framing alone changes how you scope an assessment

[Szeth @szzeth]

@helpnetsecurity @MicrosoftAI The provision that matters most to practitioners: authorized and lawful defensive work is explicitly permitted - vulnerability discovery, malware analysis, PoC exploit development, etc.

[Szeth @szzeth]

Everyone's posting agent attacks. Fewer are posting what actually contains them:
•allowlist stdio commands, don't denylist
•MCP config is untrusted input
•least priviledge, task-scoped tokens
•human approval on external
•log tool invocations
•sandbox the harness

[Szeth @szzeth]

@AnthropicAI The AI supply chain section deserves its own report.

A stolen API key isn't just loot. It's compute billed to the victim, and cover, since the traffic is attributed to the legitimate owner.

Three wins from one credential changes how urgently you treat key hygiene.

[Szeth @szzeth]

https://t.co/asnV91Mv4r

[Szeth @szzeth]

Anthropic published their most detailed threat intelligence report yet. real actors, real operations, disrupted.

The most important finding for defenders isn't a novel AI attack technique.

It's that there weren't any. 🧵

[Szeth @szzeth]

9)Worth reading in full if you work anywhere near agents, MCP servers or AI infrastructure. Clearest public picture we have of how this is actually being used in the wild.

Report linked below 👇