Even though MCP has its own prompt injection security problems, arbitrary shell and curl access in an open network environment is much harder to keep secure, and MCP makes it easier to reason about agent capabilities and failure modes — which is why I plan to lean into MCP when building sensitive LLM applications.

A few months after MCP was first released, I wrote Model Context Protocol has prompt injection security problems, where I noted that the pattern of having end users mix and match tools pushed responsibility for avoiding data exfiltration attacks out to the users themselves. I hadn't coined the Lethal Trifecta yet, but that was absolutely what I had in mind. Then general agents with arbitrary shell and curl access came along, and that's so much harder to keep secure! Something I've come to appreciate about MCP is that it's much easier to reason about agent capabilities and what might go wrong than with arbitrary command execution in an open network environment - the default for most of today's general and coding agent tools. I plan to lean into MCP a whole lot more when I'm building sensitive applications on top of LLMs.

Read full article ↗excerpt · fair-use quotation