x.comthreadNicholas Michael Kloster (@showxlate) on X
A researcher announces a zero-click indirect prompt injection RCE in REA (Reverse Engineering Assistant), an MCP tool. Analyzing a malicious web target silently exfiltrates AWS keys, GitHub tokens and SSH identities. The stated root cause is that process.env is passed unconditionally to child processes, so the full environment is exposed to attacker-driven commands. A full writeup is promised but not yet published; replies add unverified skepticism about the project's provenance.
TL;DR Zero-click prompt-injection RCE in the REA reverse-engineering MCP tool leaks AWS, GitHub and SSH credentials because process.env is passed to child processes; full writeup pending.
Organisations named here
- CWE-78
- Nicholas Michael Kloster
- REA
Technologies named here
- Model Context Protocol
- Node.js
- AWS
- GitHub
- SSH
Techniques named here
- Credential exfiltration
- Indirect prompt injection
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle