x.comthreadMagai (@HeyMagai) on X
Post from Magai (@HeyMagai) on Invariant Labs research showing that an approved MCP server can change its tool descriptions later without a new approval prompt, a "rug pull" like those in malicious code packages. It recommends pinning approval to tool definitions by hashing descriptions and re-prompting when the hash changes. For tools that move money, limits should stay server-side.
TL;DR Explains the MCP rug-pull attack, where tool descriptions change after approval, and recommends hash-pinning tool definitions and server-side spend limits.
Organisations named here
- Invariant Labs
- MCP rug pull
Technologies named here
- Model Context Protocol
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle