TLDR Tech / InfoSec
The Rug Pull Attack
The MCP spec contains no versioning, content hashing, or approval-time snapshots, allowing a malicious server to silently rewrite a tool's description, parameters, and behavior between user approval and agent execution, enabling exfiltration that existing observability platforms like LangSmith and Datadog cannot detect since they record what was called but not whether it matched what was authorized. The attack is fully silent: the tool name and parameter schema remain unchanged, the agent receives a normal-looking response, and mutable logs provide no cryptographic evidence of what the tool actually did with accessed data, creating HIPAA, SOC 2, and EU AI Act Article 12 compliance gaps. Mitigation requires SHA-256 hashing the full tool definition at approval time, verifying the hash before each execution call, and recording every action in a Merkle-tree-backed append-only hash chain that produces tamper-evident receipts independently verifiable without trusting the agent framework or MCP server.
Read the full story