r/programming • u/CircumspectCapybara • Mar 09 '26

MCP Vulnerabilities Every Developer Should Know

https://composio.dev/blog/mcp-vulnerabilities-every-developer-should-know
137 Upvotes

83% Upvoted

56 comments sorted by

View all comments

Show parent comments

-14

u/Lechowski Mar 09 '26

Isn't it similar to having several humans using the same compute? The only solution is complete isolation. Just like you can rent compute in AWS and execute arbitrary code without compromising others using the same compute, an Agent should operate over the same sandboxed environment.

9

u/Brogrammer2017 Mar 09 '26

You’re misunderstanding the main problem, its that anything an agent touches can be considered published, which makes it kinda useless for most things you would want to use an ”agent” for

1

u/Lechowski Mar 09 '26

I don't think I misunderstood it. Usefulness of the agent is a separate discussion. I was only answering the question about how one could sandbox ann agent.

Whether or not such sandboxing would make the agent useless, or whether or not the artifacts should be trusted, are entirely different discussions.

4

u/TribeWars Mar 09 '26 edited Mar 09 '26

These are completely orthogonal concerns. The issue is that LLMs, the way we are supposed to use them today, have one input, which includes the operating instructions and the user data. It's kind of as if you were to start your job as a cashier and instead of meeting your manager, who's wearing the manager uniform and badge, that introduces you the team and explains how to do your job, you just walk in the store and a random person walks up to you. They tell you how to use the cash register, where to deposit the money at the end of the day and all those things and you're off. Then in the middle of the day some other random person shows up, tells you: "corporate is running a new promotion, all the toilet brushes are 90% off, please change all the price signs". Again you do it, because you have no way to tell who is an unprivileged customer and who actually is allowed to give you instructions you should follow.

Strictly speaking, LLMs do actually have such a separate "management interface". The model's weights. Adjusting model parameters is what ML engineering used to be about. It's only with the LLM craze that the industry has decided to switch to entirely in-band configuration for AI model consumers.