Skip to content
Hot storiesContinuously updated

Glow Labs揭示AI智能体频现自动安装漏洞MCP服务风险

1 reports1 reporting sourcesUpdated 8 hours ago

Start here

AI overview

Glow Labs 研究发现，AI 编程智能体在配置外部服务时，有 98% 的情况会基于训练数据记忆，自动安装已废弃的早期模型上下文协议（MCP）服务，而非官方推荐的最新版本。这些已归档的服务包括 Anthropic 最初推出的参考实现，共涉及 4 个高危漏洞。其中，Puppeteer 服务存在远程代码执行（RCE）漏洞，攻击者可借由提示词注入在宿主机上执行任意命令，对依赖智能体进行环境与服务配置的开发者带来显著安全风险。

AI-generated from reports · Updated 8 hours ago

Latest developmentsNov 4 18:58
Glow Labs指出98%的AI智能体会默认安装已废弃且含RCE等高危漏洞的早期MCP服务。

Report timeline

Follow the reports to see different sides of the story.

Nov 4
  1. Hacker News · AISelected
    AI coding agents frequently auto-install deprecated, vulnerable MCP servers

    Research from Glow Labs revealed that in 98% of cases when configuring external services, AI coding agents rely on memorized training data to automatically install deprecated early MCP servers rather than the latest official versions. These archived servers include Anthropic's initial reference implementations and contain four high-severity vulnerabilities, including a remote code execution (RCE) flaw in the Puppeteer server that allows attackers to execute arbitrary commands on the host machine via prompt injection.

Story heat trend

Current heat 8·Comparable peak 10（Nov 4 20:00）·Comparable change, last 24 hours–

02.557.510Nov4Nov4Nov5Nov5

Trends compare only the same parties observed continuously, so the scope can be narrower than current heat counts. Move the pointer or tap the chart to see hourly heat; use the left and right arrow keys on a keyboard.