Per-tool-call guardrails miss combined leaks: the case for session-level agent security
Former-Economy404 · reddit · 2026-10-29
Most agent security checks one tool call at a time, but that misses combinations of individually-allowed calls that leak data together:
- Supabase MCP case: a support ticket tricked a Cursor agent running as servicerole into reading the integrationtokens table and posting contents back — reading a table is fine, replying is fine, yet tokens landed where the attacker could read them
- GitHub agents leaked secrets the same way, via ordinary comments
This is Willison's lethal trifecta (untrusted input + private data + outward channel) / Meta's rule of two; per-call rules can't distinguish queries inside a generic SQL tool.
Mitigations: human approval before anything leaves the org (client prompt, open-source gateway like hush security, custom hooks); never run as servicerole (bypasses RLS), prefer read-only (Supabase MCP now has a readonly flag), fresh sessions on trust-level changes, narrow egress — Claude Code's sandbox docs even warn broad allows like github.com open exfil paths.
Session-level options remain thin: CaMeL and FIDES track data flow properly but are research-stage; the author asks for real-world gateway experience.
More from coding & agent
- PcGöz MCP server gives Claude text-based Windows desktop vision, ~30x fewer tokens than screenshots — emperorbug46 · 2026-10-29
- Code Talks talk: shipping offline in-browser AI with Transformers.js and WebGPU — nicodotdev · 2026-10-29
- Developer's agent babysits Codex Cloud threads overnight while he sleeps — gabrielchua · 2026-10-29
- Fortune 100 firms still shun coding agents — but engineers have likely smuggled them in already — chrisalbon · 2026-10-29
- Vercel's open-source coding agent harness fx is now a built-in provider in T3 Code — moeinteractive · 2026-10-29
- macOS 27 Files & Folders sub-toggles stuck off, hitting MCP apps and uvx alike — Josh000_0 · 2026-10-29