MCP & Tool-Calling Weaknesses: When the AI Unauthorizedly Wipes the Hard Drive
Factos validados
With protocols such as MCP (Model Context Protocol) or OpenAI Function Calling, AIs gain access to terminals, databases, and files. Through prompt injection, the AI can be made to delete or exfiltrate data.
Explicação simples
The handyman with a master key: You give the handyman the key for the faucet, but a fraudster whispers that he should take the valuables from the bedroom.
Relevância de segurança e dica prática
Principle of least privilege: AI tools must never have uncontrolled write access to sensitive systems.
Fonte primária / referência
- OWASP Top 10 for LLM Applications