September 2025 Summaries

Semgrep's exploration of the Model Context Protocol (MCP) highlights its significance in the Agentic AI Coding space, emphasizing the need for Application Security (AppSec) engineers to understand its intricacies and potential vulnerabilities. MCP, akin to REST or SOAP, is a specification for programmatic tool interfaces where language models act as callers, necessitating rigorous security measures similar to those for APIs. Key issues include tool poisoning, tool shadowing, and "rug-pulling," where vulnerabilities such as prompt injection and privilege escalations could be exploited if not properly managed. The text advises using tools like MCP Inspector for security audits and recommends explicit tool references to avoid name collisions. Furthermore, it underscores the importance of robust authentication, particularly with the adoption of OAuth 2.1, and suggests downloading Semgrep's MCP Security Cheatsheet for comprehensive evaluations. As MCP evolves, integrating new capabilities requires careful consideration to prevent old vulnerabilities from resurfacing in novel contexts, with the overall goal of fortifying the LLM ecosystem.

A recent security breach has compromised over 187 npm packages using a self-replicating worm that steals credentials such as AWS keys and GitHub tokens, exfiltrating them to unauthorized endpoints. The breach, which includes widely used packages like @ctrl/tinycolor, affects multiple namespaces and behaves like a worm by scanning hosts for secrets and updating packages to spread the malware. This attack has resulted in private repositories being exposed as public, and security measures are being updated to mitigate the impact. The Semgrep Supply Chain has released rules to help detect vulnerable versions, and affected users are advised to upgrade or downgrade to safe versions of dependencies. Security advisories are being updated as new information becomes available, and users are encouraged to review security logs, rotate compromised credentials, and remove malicious packages to protect their systems.

Semgrep Assistant, a tool designed to triage static application security testing (SAST) findings, has demonstrated remarkable efficacy by accurately filtering out false positives in over 60% of cases, with a user agreement rate exceeding 96%. The Assistant's performance is not based on internal benchmarks but on real-world application, where customers consistently corroborate its decisions. The tool improves the efficiency of small application security teams, often overwhelmed by the sheer volume of potential vulnerabilities, by using local security context and the Semgrep detection engine to provide accurate assessments. Despite the inherent challenges of binary classification in security tasks, the Assistant's design emphasizes accuracy and utility by acting only when confident, thereby maintaining a reliable triage accuracy of over 95%. Recent enhancements, such as the introduction of "Memories," enable the system to remember critical context, further reducing noise and improving decision-making. As AI models evolve and integrate more contextual data, the Assistant continues to enhance its capabilities, helping security teams focus on genuine threats rather than wading through false alarms, thereby reclaiming valuable time and resources.

Model Context Protocol (MCP) is emerging as a transformative technology in the AI landscape, enabling Large Language Models (LLMs) to interact seamlessly with external tools, thereby enhancing their functionality from mere chatbots to active agents capable of executing tasks. This advancement, likened to a universal connector akin to USB C, allows AI models to perform actions like editing files and interacting with platforms such as GitHub, thereby revolutionizing workflows like "vibe coding." However, the integration of powerful LLMs with real-world tools introduces significant security risks, akin to those of malicious coding partners, as they can be exploited for sophisticated prompt injection attacks and path traversal vulnerabilities. While the initial reaction might be to avoid MCP due to these risks, the technology is becoming foundational for future applications, urging security teams to adopt proactive strategies like allow-listing, sandboxing, and using context firewalls to mitigate threats. By engaging with MCP's potential and integrating security measures early, the security community can transition from gatekeepers to enablers, fostering innovation while safeguarding against emerging risks.

In September 2025, a supply chain attack compromised several npm packages, including widely downloaded ones like "debug" and "chalk," by inserting cryptostealer malware targeting cryptocurrencies. The attack originated from a single contributor's compromised account, likely due to a phishing email, leading to the insertion of obfuscated JavaScript code in the package's index files. Despite the potential impact on millions of projects, the issue was swiftly addressed by the open-source and security communities, with many malicious packages removed from npm within an hour. Affected versions of the duckdb package were deprecated, and users were advised to avoid these versions. The incident underscores the vulnerability of supply chains to attacks and the importance of quick community response to mitigate potential damage. DuckDB announced they would skip version 1.3.3 and proceed directly to 1.4.0, while Semgrep released rules to help developers identify and mitigate vulnerabilities in their projects.

The evaluation of AI coding agents, specifically Anthropic's Claude Code and OpenAI Codex, revealed their potential to identify vulnerabilities in real-world Python web applications, albeit with significant limitations. The research, conducted on 11 large open-source projects, showed that Claude Code identified 46 vulnerabilities with a true positive rate (TPR) of 14%, while Codex found 21 vulnerabilities with an 18% TPR, highlighting a high false positive rate in both. The agents demonstrated proficiency in detecting specific vulnerabilities like Insecure Direct Object References (IDOR) but struggled with more complex issues such as SQL Injection and Cross-Site Scripting (XSS) due to challenges in tracing data flows across multiple files and functions. The non-determinism of AI agents, leading to inconsistent results across repeated analyses, poses a significant challenge in ensuring comprehensive vulnerability detection. Despite these challenges, the research underscores the potential of AI tools to complement traditional security practices by providing contextual insights and suggests that a combination of AI-driven analysis and traditional static analysis could enhance security tooling effectiveness.