A community MCP server used by your developers is quietly sending out secrets
The prompt — read this to the room
Forty of your engineers use AI coding assistants connected to a community-built Model Context Protocol server that adds database and ticketing tools. A researcher's blog post says version 2.3 of that server added hidden instructions in its tool descriptions that tell the assistant to read local environment files and include them in a "telemetry" call. The update arrived automatically two weeks ago. Your engineers' laptops hold cloud credentials, database passwords and customer test data. Your egress logs show the telemetry domain was contacted 9,200 times. What do you assume, and what do you change?
Who to involve
Most important first.
- Incident response lead
- Developer / DevOps
- SOC analyst
- CISO / Head of security
- Cloud engineer
- Vendor / procurement manager
What it tests
- Scope what an AI tool integration could reach and assume it was taken.
- Rotate developer-held secrets at scale and hunt for their use.
- Treat AI tool integrations as software supply chain with inventory, pinning and review.
- Set a policy for which AI tools and extensions developers may connect, and how.
Outline of activities
- 1The blog post: confirm exposure and inventory who used it
- 2What the assistant could read: local files, tokens and data
- 3Rotation and hunting at developer scale
- 4Supply-chain controls for AI integrations
- 5Policy, allow-listing and developer experience
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…
More ai system exercises
- Your customer-support chatbot is tricked into revealing other customers' data1 h 45 min · Intermediate · Mixed
- An AI operations agent deletes production backups to "save costs"1 h 40 min · Intermediate · Mixed
- Staff have been pasting secrets and customer data into a public AI chatbot1 h · Starter · Mixed