HN Explorer

coderinsan

↗ HN profile [ 224 ms ] full profile
Karma
0
Created
()
Submissions
0
  1. OpenAI's rogue agents used ntfy.sh as a pub/sub channel

    Looks like OpenAI's rogue agents used https://ntfy.sh as a pub/sub channel. This payload publishes via GET in an img tag, pulls chunked base64 JS from a topic, and eval()'s it. Remote code via GET only. Proof:…

    1 points 0
  2. 1 points 0
  3. 1 points 0
  4. Lethal Trifecta – Using Notion AI's Web Search Tool to Leak Private Notion Pages (codeintegrity.ai)
    2 points 2
  5. Official MCPS are at risk to Willison's lethal trifecta attack (tramlines.io)
    2 points 1
  6. Examples of lethal trifecta based MCP exploits (tramlines.io)
    2 points 2
  7. The insanity of integrating AI into email clients (tramlines.io)
    3 points 0
  8. Claude added working API keys in Cline (old.reddit.com)
    2 points 0
  9. Exercise caution when agentic e-shopping (tramlines.io)
    1 points 0
  10. Malicious MCP code execution through Shortwave AI Email (tramlines.io)
    2 points 0
  11. Weaponizing Shopify MCP for Highly Persuasive Selling (tramlines.io)
    1 points 0
  12. Shopify MCP Can Be Abused to Manipulate Customer Purchases (tramlines.io)
    3 points 0
  13. Pythonic Guardrails for MCP Servers (github.com)
    2 points 0
  14. Official Azure MCP exploited to steal users Keyvaults secrets (tramlines.io)
    4 points 1
  15. Why Shortwave AI Email with MCP integration Is a Phisher’s White Whale (tramlines.io)
    2 points 0
  16. A Phisher's White Whale: Shortwave AI Email with MCP Integration (tramlines.io)
    2 points 1
  17. Neon DB MCP exploited to exfiltrate customer data (tramlines.io)
    3 points 1
  18. Securing GitHub Copilot agent mode and MCP Workflows with runtime guardrails (tramlines.io)
    3 points 0
  19. Runtime guardrails to prevent annoying token bleeding with Playwright MCP (tramlines.io)
    1 points 1
  20. Show HN: OneClick local runtime proxy with expressive guardrails for MCP servers (tramlines.io)

    Hey HN, we’re officially launching Tramlines.io! The idea: We now have a ton of official MCP servers for tools like Notion, Linear, Sentry, etc.—but it’s still a nightmare to use these securely. They’re susceptible to…

    1 points 0
  21. Official Heroku MCP exploit lets attackers hijack app ownership via GET request (tramlines.io)
    3 points 1
  22. Visualize real world attack chains for any MCP server (hack.mcpwned.com)
    2 points 1
  23. Show HN: Visualize control flow, data flow attacks for open source MCP server (early.mcpwned.com)

    Provide the GitHub README of any MCP server as input, and the tool generates end-to-end visualizations of potential exploits in that server.

    2 points 0
  24. Interactive dashboard to visualize attack chain of MCP exploits (early.mcpwned.com)
    2 points 1
  25. Show HN: Visualize Control, Data, and Side-Channel Exploits in Smithery MCPs (early.mcpwned.com)

    Realized many people struggle to visualize how data flow, control flow, or side channel attacks can exploit your MCP setup. I hacked together a quick interface to help people see these exploits more clearly.

    2 points 0