Cyber Sentries: AI Insight to Cloud Security

The episode packs substantial technical depth with concrete vulnerability analysis, real-world supply chain attacks, and layered security implications. Ferry moves beyond platitudes by detailing the smithery.ai path traversal exploit, token scope issues, and the proliferation of identities problem in agentic systems. However, some discussion circles back to familiar fundamentals (least privilege, observability) that reduce novelty density in the latter half.

“They had a small configuration file you need to add in your code repository. In the parsing of that configuration file, there was a vulnerability that is well known and called a path traversal. Basically, you could change the path of the repository on their infrastructure and get access to pretty much everything you wanted.”

“This token was poorly scoped and gave access to the whole API of Fly.io, which includes code execution on any machine they host.”

Ferry brings fresh perspective on how rapid AI adoption (MCP → Skills pivot) compresses security maturity cycles and shows the inadequacy of OAuth as a silver bullet for agent identity problems. The framing of behavioral/context-aware authorization as a gap is thoughtful. However, the core arguments about secrets management, supply chain risk, and privilege creep are well-established security tropes applied to a new domain rather than fundamentally novel frameworks.

“When you have a new technology coming out, everyone wants to take their share of the treasure and wants to go as fast as possible to provide new services leveraging those technologies.”

“I don't think we solve anything with OAuth in MCP. I mean, we solve the issue MCP had. But we've been using OAuth for years... The real issue we have is that systems, agents, and things like this come with a lot of identities.”

Ferry is a credible security researcher with 7-8 years red team experience and institutional backing from GitGuardian, giving him legitimate operational exposure. He demonstrates hands-on exploit knowledge and vulnerability responsibly disclosed to vendors. However, he is a researcher rather than an operator who has built or scaled agentic systems in production, limiting his ability to speak to operational trade-offs operators actually face when implementing these mitigations.

“I've worked as a red teamer for around seven or eight years in a great French consulting company. That's really where I learned about offensive security and things like this.”

“I documented what could have been a pretty severe supply chain attack in MCP servers in June or July last year, if I remember correctly, with a vulnerability chain in the smithery.ai MCP hosting platform.”

Episode is rich with concrete examples: smithery.ai path traversal exploit with named hosting provider (Fly.io), 4,000 MCP servers hosting scale, CodeRabbit breach via same vector weeks later, Salesloft/Drift supply chain attack with OAuth token exfiltration, GitHub MCP prompt injection attack making repos public, mcp.json files leaking 1,200 valid secrets in three months. Ferry names specific infrastructure components, timelines (June 2025 smithery discovery), and measurable metrics throughout.

“When I exploited this vulnerability, there were a little bit more than 4,000 different MCP servers hosted on smithery.”

“over the last three months, 1,200 valid secrets - secrets that we could prove valid - were leaked in a file named mcp.json.”

Host asks solid foundational questions (how you got into security, what you found, recommendations) and occasionally probes deeper (clarifying responsible disclosure, questioning whether OAuth solves the problem). However, follow-ups often accept Ferry's answers without pushing back or asking for implementation specifics. Richards misses opportunities to challenge Ferry on whether the fundamentals advice is actionable at scale, or to request concrete examples of observability solutions mentioned. The conversation lacks productive tension.

“Can you share what you're seeing out in the field? What are the new ways we're seeing attacks, especially around MCP servers and things like that?”

“Is the answer just: use better authentication protocols, OAuth or something like that? Or is the challenge deeper than that?”