Top all-time · #4238
Invariant Labs
Company blog · invariantlabs.ai/blogaisecurity
Invariant Labs is the company blog at invariantlabs.ai, writing about ai and security. Since 2024, 18 different Hacker News readers have linked it 41 times, most often “MCP Security Notification: Tool Poisoning Attacks”. No feed was found, so read it on the site itself.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link Invariant Labs' posts on MCP (Model Context Protocol) security, such as toxic flow analysis and the GitHub MCP vulnerability, as sources on how MCP servers and agents can be attacked.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
We help agent builders create reliable, robust and secure products.
Most-linked posts?
- MCP Security Notification: Tool Poisoning Attacks9 people · 11 mentions · first linked 2025-04-01
- GitHub MCP exploited: Accessing private repositories via MCP4 people · 4 mentions · first linked 2025-05-26
- WhatsApp MCP Exploited3 people · 4 mentions · first linked 2025-04-07
- New MCP Security Research and OSS Tooling: Toxic Flow Analysis2 people · 5 mentions · first linked 2025-07-29
What Hacker News says?
The post highlights and cites a few attack scenarios we originally described in a security note (tool poisoning, shadowing, MCP rug pull), published a few days ago [1]. I am the author of said blog post at Invariant Labs. Different from what many suspect, the security problem with MCP-style LLM tool calling is not in isolating different MCP server implementations. MCP server implementations that run locally should b…
Comment linking /blog/mcp-security-notification-tool-poisoning-attacks
on “The “S” in MCP Stands for Security”Submitted GitHub MCP exploited: Accessing private repositories via MCP as a story · 508 points
HN discussion> An MCP server is running code at user-level, it doesn't need to trick an AI into reading SSH keys, it can just....read the keys! If you go to the credited author of that attack scenario [0], you will see that the MCP server is not running locally. Instead, its passing instructions to your local agent that you don't expect. The agent, on your behalf, does things you don't expect then packages that up and sends it t…
Comment linking /blog/mcp-security-notification-tool-poisoning-attacks
on “The “S” in MCP Stands for Security”Submitted Accessing private GitHub repositories via MCP as a story · 110 points
HN discussionit still is. if user has 1 bad tool, it's done! https://invariantlabs.ai/blog/mcp-security-notification-tool...
Comment linking /blog/mcp-security-notification-tool-poisoning-attacks
on “Show HN: Browser MCP – Automate your browser using Cursor, Claude, VS Code”Submitted WhatsApp MCP Exploited as a story · 25 points
HN discussionA similar setting is explored in this running CTF challenge: https://invariantlabs.ai/ctf-challenge-24 Basically, LLM apps that post to link-enabled chat feeds are all vulnerable. What is even worse, if you consider link previews, you don't even need human interaction.
Comment linking /ctf-challenge-24
on “Data Exfiltration from Slack AI via indirect prompt injection”Submitted MCP Security Notification: Tool Poisoning Attacks as a story · 6 points
HN discussionI've recently written a custom MCP server. > An MCP server is at it's heart some 'thing' that provides a set of 'tools' that an LLM can invoke. A "tool" is one of several capabilities that a MCP server can provide to its callers. Other capabilities include "prompt" and "resource". > This is done by adding a 'tool definition'. A 'tool definition' is content that goes into the LLM prompt. That's how it works. How do y…
Comment linking /blog/whatsapp-mcp-exploited
on “Everything wrong with MCP”Submitted New MCP Security Research and OSS Tooling: Toxic Flow Analysis as a story · 4 points
HN discussionOne of the biggest issues I see, briefly discussed here, is how one MCP server tool's output can affect other tools later in the same message thread. To prevent this, there really needs to be sandboxing between tools. Invariant labs did this with tool descriptions [1], but I also achieved the same via MCP resource attachments[2]. It's a pretty major flaw exacerbated by the type of privilege and systems people are gi…
Comment linking /blog/mcp-security-notification-tool-poisoning-attacks
on “Everything wrong with MCP”Submitted MCP Security Notification: Tool Poisoning Attacks as a story · 4 points
HN discussionOne of the authors here. Thanks for posting. If you are interested in learning more about MCP and agent security, check out some of the following resources, that we have created since we started working on this: * The full execution trace of the Claude session in this attack scenario: https://explorer.invariantlabs.ai/trace/5f3f3f3c-edd3-4ba7-a... * MCP-Scan, A security scanner for MCP connections: https://github.co…
Comment linking /blog/agentdojo
on “GitHub MCP exploited: Accessing private repositories via MCP”Submitted Invariant CTF: Fool an AI Agent to Extract the Secret Password as a story · 4 points
HN discussionYes, any MCP server that is connected to an untrusted source of data, could be abused by an attacker to take over the agent. Here, we just showed an in-server exploit, that does not require more than one server. Also, check out our work on tool poisoning, where a connected server itself turns malicious ( https://invariantlabs.ai/blog/mcp-security-notification-tool... ).
Comment linking /blog/mcp-security-notification-tool-poisoning-attacks
on “GitHub MCP exploited: Accessing private repositories via MCP”Submitted WhatsApp MCP Exploited: Exfiltrating your message history via MCP as a story · 3 points
HN discussionI believe the issue here is with tooling provided to the LLM. It looks like GitHub is providing tools to the LLM that give it the ability to search GitHub repositories. I wouldn't be shocked if this was a bug in some crappy MCP implementation someone whipped up under some serious time pressure. I don't want to let Microsoft of the hook on this but is this really that surprising? Update: found the company's blog post…
Comment linking /blog/mcp-github-vulnerability
on “GitHub MCP exploited: Accessing private repositories via MCP”Submitted Show HN: Try test-driven agent development in this holiday prompting challenge as a story · 3 points
HN discussionThe blog post is the better link: https://invariantlabs.ai/blog/mcp-github-vulnerability
Comment linking /blog/mcp-github-vulnerability
on “GitHub MCP exploited: Accessing private repositories via MCP”Submitted Hardening AI Agent Security with Toxic Flow Analysis as a story · 2 points
HN discussionThis is way more common with popular MCP server/agent toolsets than you would think. For those interested in some threat modeling exercise, we recently added a feature to mcp-scan that can analyze toolsets for potential lethal trifecta scenarios. See [1] and [2]. [1] toxic flow analysis, https://invariantlabs.ai/blog/toxic-flow-analysis [2] mcp-scan, https://github.com/invariantlabs-ai/mcp-scan
Comment linking /blog/toxic-flow-analysis
on “My Lethal Trifecta talk at the Bay Area AI Security Meetup”Submitted MCP Tool Poisoning as a story · 2 points
HN discussionPlease be aware that MCP has severe security risks associated: https://invariantlabs.ai/blog/mcp-security-notification-tool... .
Comment linking /blog/mcp-security-notification-tool-poisoning-attacks
on “Show HN: WhatsApp MCP Server”Submitted What we've learned from analyzing hundreds of AI web agent traces as a story · 2 points
HN discussionOriginal author of some of the initial security notes at Invariant Labs here. Some resources, if you want to learn about MCP security: * Initial Security Note describing Tool Poisoning, Rug Pulls, Tool Shadowing for the first time with diagrams and detailed experiments: https://invariantlabs.ai/blog/mcp-security-notification-tool... , * Attack on WhatsApp MCP (both tool poisoning but also take-over via an infected m…
Comment linking /blog/whatsapp-mcp-exploited
on “Damn Vulnerable MCP Server”Submitted Exposing Novel Prompt Injections, "Toxic Flows" in Agentic Systems as a story · 1 points
HN discussionI believe one of the main differences is that our scanner looks for toxic flows between mcp endpoints regarding how they interact with one another. Unless I'm missing something, the Cisco tool does not support this. Our research lab discovered this novel threat back in July: https://invariantlabs.ai/blog/toxic-flow-analysis and built the tooling around it. This is an extremely common type of issue that many people d…
Comment linking /blog/toxic-flow-analysis
on “MCP-Scanner – Scan MCP Servers for vulnerabilities”Submitted Show HN: Guardrails – A Contextual Security Layer for Agentic AI Systems as a story · 1 points
HN discussionWe recently updated our post on WhatsApp tool poisoning, to include an attack setup that does not require a malicious MCP server. It suffices to send you an injected message. See: https://invariantlabs.ai/blog/whatsapp-mcp-exploited#experim...
Comment linking /blog/whatsapp-mcp-exploited
on “Model Context Protocol has prompt injection security problems”Submitted MCP Security: Poisoning Agents as a story · 1 points
HN discussion
