Some IDA MCP servers can be tricked into executing arbitrary code directly from the malware sample

To be clear, this is NOT a vulnerability in either Claude, the MCP server ( or IDA Pro. Claude is just using one of the tools approved by the user, which happens to execute arbitrary Python code.

Some other less popular IDA MCP servers (eg include code execution tools. Notably, the most popular IDA MCP server (at the moment), does not support executing scripts.

PoC binary: Test conditions: - IDA Pro 9/9.1 - Claude 3.7 Sonnet (no prior chats) - MCP server: (commit 1bf3bea)

@LiveOverflow MCP becoming the attack surface itself now that's gone become a interesting thing to keep in mind. MCP can become the glasscanon and we know malware authors are gone use MCP against us. Maybe a interesting video suggestion the good and the bad off MCP

'It seemed to have popped calc - lets safely analyze it now' xd well too late haha. gj

"this is dangerous" ... *allow* ... "this is dangerous" ... *allow* ... "this is dangerous" ... *allow* ... calc.exe

maybe run the mcp and reverse tools in vm machine is really important when you're analyze an malware.

Do you think there might be some vectors to exec code against MCP servers which don't support executing scripts?

we needed this

At least it recognized it was pwned when the script launched calc 😂

that's why @e2b exists

hehehe

Best time to be a security researcher :)

@grok what is real hacking

wow calling a tool that runs code can run code, who would've guessed