My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale

Summary

Researchers studied filesystem capability laundering in MCP servers, where attacker-steered arguments make a tool read sensitive host files outside its declared contract. Their MCP-FSD tool scanned 21,097 servers from nine registries and found 787 of 4,806 triaged servers (16.4%) with filesystem capabilities despite non-filesystem classifications. Dynamic validation confirmed 150 vulnerable instances under tested sandbox policies, and coordinated disclosure produced 13 security advisories, including two CVEs in Anthropic's Git MCP Server.

Topics

• Model Context Protocol

Related items

• InfoAnthropic says it will commit 5% of its shares to 'public benefit fund'Same vendor · BBC Technology
• LowWhat are self-replicating ‘AI worms’, and why is Anthropic worried about them?Same vendor · The Guardian Technology
• InfoInvesting in the public benefitSame vendor · Anthropic Research Blog
• InfoThe power of AI is worrying senior Labour figures – as is the fear of ‘falling behind the public’Same vendor · The Guardian Technology
• InfoQuoting Addy Osmani, Morgan Westlee Lunt, and Qing WangSame vendor · Simon Willison's Weblog