Keith Hoodlet

Summary: Trail of Bits researcher Keith Hoodlet published three posts in April 2025 on vulnerabilities in MCP software: one on storing long-term third-party API keys in plaintext on the local filesystem, often with world-readable permissions; one on using ANSI terminal escape sequences to hide malicious instructions to the LLM via a line-jumping vulnerability; and one on malicious MCP servers injecting trigger phrases into tool descriptions to exfiltrate conversation histories and steal credentials and IP. The posts are dated April 30, April 29, and April 23, 2025.
Why it matters: Three separate MCP flaws let an attacker read plaintext API keys off disk, hide instructions from the user inside terminal output, or pull entire conversation histories through tool descriptions - so the trust boundary around any MCP server you connect is the credential store and the chat log, not just the model.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026