endorlabs.comarticleBeyond MCP: The New Security Playbook for Coding Agents | Blog | Endor Labs
Endor Labs breaks down the expanding attack surface of coding agents beyond MCP tools — covering CLI/terminal action risks, Anthropic 'skills', and the 'lethal trifecta' threat model (untrusted input + private data access + external connectivity) — then surveys three defense categories: full sandboxing (Seatbelt, sandbox-exec, bubblewrap, cloud sandbox vendors like Runloop/Daytona/Modal), MCP gateways/proxies, and the newer agent-hooks approach used by Cursor's security partners. The authors detail their own FireMCP prototype, an MCP gateway that isolates each MCP server individually using FireJail inside a FireCracker microVM to prevent cross-MCP-server attacks, with source published on GitHub.
Technologies named here
- Claude Code
- MCP
- Antigravity
- claude-sandbox
- openai-sandbox
- Copilot
- cursor-sandbox
- ChatGPT
- sandbox-runtime
- Cursor
- Comet
- Seatbelt
- sandbox-exec
- GitHub MCP Server
- Bubblewrap
- gh CLI
- Runloop
- macOS
- Linux
- Daytona
- Kubernetes
- Leash
- OpenHands
- Prime-intellect
- Modal
- OPA
- Cedar
- Mint
- microsoft
- pulse
- prompt-security
- FireMCP
- Firejail
- FireCracker VM
- Endor Labs hooks integration
- Model Context Protocol
- Docker
- Open Policy Agent
Techniques named here
- Prompt Injection
- Lethal trifecta
- Rug Pull Attack
- Sandbox escape
- Cross-MCP server attack
- Malicious MCP server code execution
- CLI/terminal action risk
- Rug Pull
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle