MCP & Tool-Calling Weaknesses: When the AI Unauthorizedly Wipes the Hard Drive
Fatti validati
With protocols such as MCP (Model Context Protocol) or OpenAI Function Calling, AIs gain access to terminals, databases, and files. Through prompt injection, the AI can be made to delete or exfiltrate data.
Spiegato in modo semplice
The handyman with a master key: You give the handyman the key for the faucet, but a fraudster whispers that he should take the valuables from the bedroom.
Rilevanza per la sicurezza e consiglio pratico
Principle of least privilege: AI tools must never have uncontrolled write access to sensitive systems.
Fonte primaria / riferimento
- OWASP Top 10 for LLM Applications