RedMonk: MCP and A2A Verify Publishers, Not Safety — Registries Become the Trust Layer
rseroter · x · 2026-10-21
RedMonk's Kate Holterhoff argues developers treat MCP and A2A as trust services, though neither was designed to vouch for what it connects. A USENIX Security study found 20% of AI-generated package references point to nonexistent packages, making hallucinated names attractive attack targets. Agents pick tools from catalogs, so a poisoned listing is a direct line in: malicious MCP servers run with user-level file and credential access, and their tool descriptions are read as instructions — as in the 2025 postmark-mcp npm exploit that BCC'd every sent email to the attacker. Registries are becoming a critical trust service.
More from coding & agent
- LukeW maps the five UI problems every AI-native company faces with agents — LukeW · 2026-10-21
- Claude Code over ADB guts a bloatware-laden Android TV, freeing ~90% more RAM — edwinarbus · 2026-10-21
- Developer uses Claude to fix his adware-slowed Xiaomi TV, releases tool for any Android TV — edwinarbus · 2026-10-21
- Open-weights Ornith-1.5-122B debuts with 84.5% SWE-bench Verified, runs on a single DGX card — _akhaliq · 2026-10-21
- People are using Claude Code to debloat ad-ridden smart TVs — edwinarbus · 2026-10-21
- crossSessionInbound=accept flagged as the key Claude Code primitive behind hive swarms — kieranklaassen · 2026-10-21