MCP-инструменты для ИИ несут риски при интеграции с криптой

cryptonews.ruОпубліковано о 2024-04-14Востаннє оновлено о 2025-04-14

По мере развития экосистемы больших языковых моделей (LLM) все больше внимания привлекают инструменты, использующие протокол Model Context Protocol (MCP). Эти решения обеспечивают связку между ИИ-моделями и внешними системами — от API до криптовалютных кошельков. MCP уже широко используется в таких продуктах, как Claude Desktop и Cursor, однако вместе с функциональностью он приносит и новые векторы атак.

Команда безопасности блокчейнов SlowMist опубликовала MCP Security Checklist — руководство по защите MCP-экосистемы от потенциальных угроз. В документе подробно описаны уязвимости на 3-х уровнях: Host (среда исполнения), Client (интерфейсы пользователя) и Server (инфраструктура), а также отдельные случаи при многопротокольной работе и в сценариях, связанных с криптовалютами.

Эксперты отмечают, что внедрение плагинов и расширений, взаимодействующих с MCP-инструментами, открывает путь для злоупотреблений. В частности, атакующие могут использовать поддельные плагины или модифицированные интерфейсы для перехвата данных или получения доступа к криптокошелькам через интеграции с ИИ.

Одной из наиболее чувствительных областей остается связка MCP и блокчейн-сервисов. Поскольку AI-инструменты, особенно в Web3-среде, всё чаще работают с криптовалютами, возникает необходимость в стандартизации механизмов безопасности. Без должных мер злоумышленники могут использовать ИИ-интерфейсы для обхода аутентификации, манипулирования транзакциями и распространения вредоносного кода.

В условиях быстрого роста числа ИИ-инструментов, использующих внешние соединения, MCP становится важной точкой контроля. Исследователи SlowMist подчеркнули, что разработчики, внедряющие ИИ в криптопространство, должны учитывать потенциальные угрозы на раннем этапе.

Публикация MCP Security Checklist призвана ускорить безопасную интеграцию между блокчейн- и AI-экосистемами. Она также поднимает важные вопросы стандартизации в сфере Web3-инструментов, где безопасность становится ключевым фактором устойчивости продуктов.

Ошибка в тексте? Выделите её мышкой и нажмите Ctrl + Enter

Пов'язані матеріали

Weekly Token Unlock: PUMP Begins Unlocking for Team and Investors.

**Weekly Token Unlocks: PUMP Begins Unlock for Team and Investors** This week features significant token unlocks for two major projects: **Pump.fun:** * The Solana-based meme coin launchpad begins unlocking 82.5 billion PUMP tokens for its team and investors. * The unlock is valued at approximately $130 million. * A release curve chart shows the planned distribution schedule for these tokens. **Hyperliquid:** * The high-performance blockchain, designed as a fully on-chain open financial system, will unlock 450,000 HYPE tokens. * The value of this unlock is around $31.98 million. * A separate chart details the specific release schedule for the Hyperliquid tokens.

marsbit8 хв тому

Weekly Token Unlock: PUMP Begins Unlocking for Team and Investors.

marsbit8 хв тому

‘May not resolve structural issues’ – Galaxy opposes JPMorgan’s dilution plan for Strategy

Galaxy Research responded to Strategy's new $1.25 billion Bitcoin monetization plan, acknowledging it as a smart move that boosted market sentiment, as seen in rising stock prices. However, Galaxy's Head of Research, Alex Thorn, cautioned that the plan does not resolve the firm's underlying structural risks, including large recurring obligations and upcoming convertible debt maturities. Thorn proposed a "middle ground" alternative: instead of selling BTC or diluting equity (MSTR), Strategy could generate income from its 847,363 BTC treasury through methods like BTC lending or options strategies on a limited portion of its holdings. This approach, tested by firms like Metaplanet, aims to address cash-flow concerns without selling assets or affecting shareholders. This contrasts with JPMorgan's recommendation to build a longer 2-3 year cash reserve buffer by selling more MSTR shares. Galaxy argues its proposal would raise necessary cash flow while better managing risks and preserving the Bitcoin treasury.

ambcrypto10 хв тому

‘May not resolve structural issues’ – Galaxy opposes JPMorgan’s dilution plan for Strategy

ambcrypto10 хв тому

How Hinkal protocol’s smart contract flaw sparked $820K USDC exploit

The Hinkal stablecoin privacy protocol suffered an exploit resulting in the loss of approximately $820,000 worth of USDC. The attack was enabled by a flaw in one of the protocol's smart contracts. The attacker manipulated the `prooflessDeposit()` function and executed a series of `transact()` calls, allowing them to withdraw funds that should not have been accessible. While the exact technical vulnerability remains unclear, it points to a failure in deposit validation or proof verification within Hinkal's privacy architecture. This incident highlights the persistent risk of smart contract bugs in DeFi, even as overall losses in the first half of 2026 are reported to be less than half of those from the same period in 2025.

ambcrypto2 год тому

How Hinkal protocol’s smart contract flaw sparked $820K USDC exploit

ambcrypto2 год тому

CLARITY Act path clears as U.S. Sheriffs drop opposition – Reasons explained!

The CLARITY Act, a crypto market structure bill, has seen improved support as the Major County Sheriffs of America (MCSA) shifted its position from opposition to neutral, particularly regarding Section 604 which offers developer protections. This change addresses prior law enforcement concerns about facilitating illicit finance. However, new ethics concerns have emerged following reports that former President Donald Trump's crypto ventures yielded over $1.4 billion in 2025, including significant profits from an "Official Trump" memecoin. In response, Senator Kirsten Gillibrand has renewed calls for provisions to bar elected officials from creating their own crypto tokens, warning that such self-dealing could threaten the bill's broader goals. While the final text is expected soon with a potential Senate vote this month, analysts are split on its chances of becoming law this year, as debates over ethics provisions could potentially derail its progress.

ambcrypto6 год тому

CLARITY Act path clears as U.S. Sheriffs drop opposition – Reasons explained!

ambcrypto6 год тому

Strike While the Iron is Hot: GPT-5.6's Three Major Models Fully Exposed, Scheduled for July 7th?

GPT-5.6 Models Leaked, Rumored for July 7th Release A leak from the Codex application's source code has revealed references to three upcoming GPT-5.6 sub-models: Sol, Terra, and Luna. A new "speed dial" feature was also discovered, suggesting users will be able to balance response speed and quality. According to rumors, OpenAI is targeting a release window of July 7th to 9th, strategically timed to coincide with the expiration of access limits for Anthropic's Claude Fable 5 model. Early comparative tests between a leaked GPT-5.6-terra version and Fable 5 show GPT-5.6 achieving similar or better results while using significantly fewer computational resources and responding faster. In complex coding tasks, GPT-5.6 demonstrated more efficient and user-collaborative problem-solving. The reported launch date appears calculated to capitalize on growing user frustration with competitor models. Anthropic's Fable 5 has faced criticism for overly aggressive safety filters that frequently downgrade responses and for severe "hallucination" issues in its Opus 4.8 model. Leaks also suggest GPT-5.6 Sol could be offered at a much lower price than Fable 5 while matching its performance. A final note warns developers with unused "rate limit reset" credits in Codex to use them before they expire around July 12th, ahead of the anticipated GPT-5.6 launch.

marsbit6 год тому

Strike While the Iron is Hot: GPT-5.6's Three Major Models Fully Exposed, Scheduled for July 7th?

marsbit6 год тому

Торгівля

Спот