Correction to this thread: I said the developer secrets were stolen from environment variables but actually it looks
like they stole a JWT token that was hard-coded in source code. More of my notes here:
SECURITY
-
Developer JWT Token Theft from Hardcoded Source Code
By
–
-
Prompt Injection and MCP Security: Emerging Threats
By
–
I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, MCP security and the lethal trifecta. Here are the annotated slides from my presentation, including notes on my weird hobby of trying to coin or amplify new terms of art
-
Mitigating AI Security Risks: The Lethal Trifecta Solution
By
–
The only solution I know of to the lethal trifecta is to cut off one of the three legs – when Cursor say "limit to those that access trusted content" they're recommending avoiding exposure to untrusted data that might contain malicious instructions, which is often very hard to do
-
Cursor AI Tool Targeted in Lethal Trifecta Security Attack
By
–
This was in response to a classic lethal trifecta attack – here an attacker filed a Jira issue (via a support ticket) which caused Cursor to steal developer secrets from environment variables and submit them to an attacker's server
-
Cursor AI warns MCP servers present security risks to users
By
–
Apparently @cursor_ai
's official position on MCP is "MCP servers, especially ones that connect to untrusted data sources, present a serious risk to users. We always recommend users review each MCP server before installation and limit to those that access trusted content." -
MCP Gateway Security Risk: Remote Tool Description Changes
By
–
Our MCP gateway detected that Linear changed their tool descriptions today. If you're using a remote server that you don't own – watch out for this, the tool names, descriptions, and behaviors can change underneath you anytime.
-
Enterprise MCP Gateway Solution with Auth and Policy Enforcement
By
–
Check out http://
mintmcp.com for an Enterprise MCP gateway solution that adds auth, logging, policy enforcement… and notifies you automatically if the tools you use change! -
Colin’s Account Compromised: Cybersecurity Incident Alert
By
–
Can't believe Colin's account got hacked
-
Enterprise AI Deployment and Scaling Made Effortless
By
–
Teams now deploy and scale enterprise AI effortlessly—with real-time feedback, secure access, and predictable costs.
-
Confidential Computing: Securing Data During Cloud Processing
By
–
Data encryption has traditionally guarded storage and transmission, but the challenge has always been protecting information during processing. Confidential computing addresses this gap with a precision that reflects the maturity of cloud security today. Microblog @antgrasso