The MCP hype is real, but top of HN?
That's like saying that if anyone can submit random queries to a Postgres database with full access, it can leak the database.
That's like middle-school-level SQL trivia.
replies(3):
That's like saying that if anyone can submit random queries to a Postgres database with full access, it can leak the database.
That's like middle-school-level SQL trivia.
The problem as more subtle than that.
Here, we are saying that if the developer of a site - who can already submit random queries to Postgres any time they like - rigs up an LLM-powered assistant to help them do that, an attacker can trick that assistant into running queries on the attacker's behalf by sneaking malicious text into the system such that it is visible to the LLM in one of the database tables.
> who can already submit random queries to Postgres any time they like
A predefined, static set of queries curated by a human with common sense. LLMs have no common sense. They have context.
An LLM that takes user input and has access to a database can generate and run any query. We don't understand what queries might be generated and under what input, and I don't think we will anytime soon.