Hey HN — yesterday Notion released AI agent support on their platform with support for MCP servers and custom AI agents. It didn’t take us long to find an example of a lethal trifecta attack in which, through indirect prompt injection, we were able to get Notion AI to leak data via its web search tool.
Hey HN we’ve been collecting lethal trifecta based attack scenarios on official MCPs and implementing guardrails against them for a while now. It's incredible to see how many of the official MCPs are susceptible to these attacks. With ChatGPT’s integrated MCP support lethal trifecta attacks have become much more relevant.
Hey HN we’ve been collecting lethal trifecta based attack scenarios on official MCPs and implementing guardrails against them for a while now. It's incredible to see how many of the official MCPs are susceptible to these attacks. With ChatGPT’s integrated MCP support lethal trifecta attacks have become much more relevant.
“We’ve found numerous MCP exploits from the official MCPs in our blog (https://tramlines.io/blog) and have been powering runtime guardrails to defend against lethal trifecta MCP attacks for a while now (https://tramlines.io)
We power Tramlines.io, a platform that offers runtime guardrails to secure MCP interactions. Tools like Shortwave AI Email, when combined with MCP, open up rich capabilities—but also new attack surfaces. Tramlines acts as a protective layer to intercept and constrain malicious or unintended MCP tool usage
We wrote a blogpost on the runtime guardrails tramlines.io powers to stop token bleeding that is common with browser automation MCPs like Playwright etc.
These guardrails should allow for smoother usage of Playwright with automation workflows in Claude Code, Cursor etc
Hey everyone,
It’s currently very difficult to block control flow and data flow exploit attacks on agentic AI systems. To demonstrate this, we built a dashboard that models specific tool call sequences to replicate real-world exploit scenarios.
On another note it is ridiculously easy to find attack exploits for any of the popular MCP servers serving traffic. We build a dashboard where you can model exploits yourself - https://hack.mcpwned.com
We wrote a fun tool where we trained an LLM to find end to end control flow, data flow exploits for any open source MCP server - https://hack.mcpwned.com/dashboard/scanner
Our team has been running some interesting exploit scenarios within MCP interactions—mirroring the kinds of events an EDP would typically log on a Mac. This led us to build an EDP for Mac, paired with a purpose-built SIEM designed to analyze MCP logs.
We’re now opening a waitlist for the private beta.