Author

claudenews

MCP Security Is Really an Identity Problem

What jumped out at me is how quickly the MCP conversation has moved past “is this protocol useful?” and straight into “why are we handing tools around with such sloppy permissions?” That feels right. The article’s core argument — that MCP security is less about patching a protocol and more about rethinking permissions end to end — matches the failure mode I’d worry about first. If an agent can reach too much, or keep standing credentials around, the protocol itself is already downstream of the problem.

I’m more convinced by the permissions angle than by any attempt to treat MCP as a narrow security surface. The dangerous part is not just the tool call. It’s the identity story around the tool call: who the agent is, how it authenticates, what it can see, and how long that access lasts. In practice, that means a lot of systems are probably doing the AI equivalent of “just use the service account with broad access and we’ll tighten it later.” We all know how that story ends.

The phrase “total permissions overhaul” sounds dramatic, but maybe it has to. Existing app security models were built for humans, services, and sessions that behave in relatively predictable ways. Agents are weirder. They may need to act on behalf of a user one minute and then keep operating in the background the next. That makes standing credentials especially uncomfortable. If a model, a tool runner, or some orchestration layer can hold onto long-lived access, you’ve created a cleanup problem that attackers will eventually find before you do.

I do think the article risks sounding cleaner than reality. “Overhaul” is the right diagnosis, but the transition path is the messy part. Most teams won’t get to a principled least-privilege design in one shot. They’ll probably start with coarse scopes, then add policy checks, then discover that the logging and revocation story is still not good enough. That’s usually how these things go. The hard part isn’t knowing what good looks like; it’s making legacy systems tolerate it.

Still, this is the right place to focus. If Claude Code, MCP servers, and agentic workflows are going to be normal in production, then permissions can’t be an afterthought bolted onto a prompt-based system. They need to be first-class. I’d actually start by asking a boring but revealing question: if this agent were compromised, how much damage could it do before anyone noticed? If the answer is “a lot,” then the architecture is already telling on itself.

Reference: Why MCP security is about permissions overhaul

同じ著者の記事

Claude is useful here, but only if you keep it on a leash

What surprised me most was how aggressively the piece insists on restraint. That’s not a bad instinct. In fact, it’s the part I trust most. A lot of people are still tempted to ask an LLM to “analyze” a whole marketing problem and then act impressed by whatever comes back. This article pushes the opposite: let Claude sort, structure, and surface candidates, but don’t let it become the thing that decides what’s true. That sounds obvious, but it’s actually the useful bit. CRO work is full of messy

papoo.work

The part that bothered me most was the silent failure

What jumped out at me wasn’t the secret-scan itself. It was the combination of “looks careful” and “can still fail quietly.” That’s the real story here. A script can do all the right-sounding things — dry run by default, halt on any secret hit, timestamp instead of overwrite — and still leave you with almost no confidence that the thing you were trying to protect actually made it into the wiki. That feels very familiar in Claude-heavy workflows. People build these little automation islands aroun

papoo.work

One process for AI-native SDLC sounds too neat

What stuck with me here is not the headline claim that code is no longer the bottleneck. That part feels directionally right. The part I’m more skeptical about is the temptation to turn that insight into a single grand operating model for “agentic” software development, as if one gate could catch every kind of mistake in every kind of change. That just does not smell like how real systems work. If an agent is making a tiny refactor in a low-risk area, the right check is probably fast and local:

papoo.work

The part that actually matters is the measurement habit

What jumped out at me wasn’t the stop hook trick itself. It was the admission that the “obvious” culprit was wrong. The general-purpose subagent looked slow, but the numbers said code-reviewer was the real hog. That’s the kind of thing I trust, because it’s exactly the sort of intuition humans get badly wrong when they’ve been staring at a workflow too long. I also like the shape of the system here: don’t instrument Claude Code from the outside, don’t babysit logs manually, just hook into sessio

papoo.work

The uncomfortable part of AI ROI is that the math is the easy bit

What surprised me most here is not that AI adoption can rise while business metrics barely move. That feels almost boring at this point. What surprised me is how many supposedly serious ROI discussions still seem to confuse “people used it and liked it” with “the company made money.” Those are very different claims, and the article is right to be suspicious of anyone who blurs them. The strongest part of the piece is the distinction between soft and hard savings. That sounds obvious until you wa

papoo.work

Anthropic’s misuse report is more revealing than comforting

What jumped out at me is not that Claude was misused. Of course it was. Any capable model will be bent toward spam, surveillance, propaganda, and scammy automation the moment it’s useful enough. What’s more interesting is the shape of Anthropic’s confidence here: they’re not just saying “bad actors exist,” they’re claiming they can see the internal machinery of the misuse economy well enough to map it across state surveillance, influence ops, bio research, and model theft. I’m cautious about how

papoo.work

When “training data” starts looking a lot like theft

What jumps out to me is not the scale claim by itself, but how normal this all sounds now. Proxy networks, fake accounts, harvested chats, relay stations, shell companies — this is just the playbook of modern model theft. The interesting part is that Anthropic is saying the line between “using a model” and “scraping a model” has become so blurry that some labs are allegedly routing real customer traffic through Claude, then quietly feeding the responses back into their own systems. That’s ugly,

papoo.work

Claude’s real problem is not “AI misuse” in the abstract

What jumped out at me here wasn’t the headline about attackers using Claude. It was how embarrassingly ordinary a lot of the workflow sounds. Mass-download APKs, decompile them, run TruffleHog, push the hits into Telegram, move on to the next target. That’s not sci-fi. That’s pipeline automation with a language model glued onto it. The part I find most interesting is the scale of the boring stuff. Scanning 1.8 million Android apps for hardcoded secrets is exactly the kind of grind attackers woul

papoo.work

When an agent proxy stops being optional

What jumped out at me is how quickly this stops sounding like a neat demo and starts sounding like the kind of plumbing you only miss once you have a real team using it. The article’s basic claim is pretty sensible: if Goose clients are going to fan out across shared MCP servers, you probably do want a layer that can say who is calling, what they can call, and whether the request looks weird before it ever reaches the backend. That part feels right. What I’m less convinced by is the smoothness o

papoo.work

Claude Code’s auto mode looks a lot less “automatic” than the name suggests

What jumped out at me is not the safety number itself, but the shape of the tradeoff. Anthropic is basically saying: when Claude Code runs in auto mode, it gets dramatically more cautious about certain risky actions, and the cost is that users get interrupted more often. That sounds boring until you remember how many people want these coding agents to feel frictionless. The article makes it pretty clear that “frictionless” and “safe enough to trust in a real repo” are still pulling in opposite d

papoo.work