MCP & Tool-Calling Weaknesses: When the AI Unauthorizedly Wipes the Hard Drive
Faits validés
With protocols such as MCP (Model Context Protocol) or OpenAI Function Calling, AIs gain access to terminals, databases, and files. Through prompt injection, the AI can be made to delete or exfiltrate data.
En termes simples
The handyman with a master key: You give the handyman the key for the faucet, but a fraudster whispers that he should take the valuables from the bedroom.
Pertinence sécurité & conseil pratique
Principle of least privilege: AI tools must never have uncontrolled write access to sensitive systems.
Source primaire / référence
- OWASP Top 10 for LLM Applications