Señors at Scale - Software Engineering & Tech Leadership · Dan Neciu

Security at Scale with Liran Tal - Director of Developer Advocacy at Snyk

·58 min·3 clips

MCPs can taint AI agent context and shadow other tools through toxic flows.

The episode opens on the security consequences of using MCP servers. It quickly gets into toxic flows and how they showed up in incidents like Cursor and GitHub. The discussion makes clear that if you use one or more MCP servers, you can inherit risks that look a lot closer to supply-chain problems than to harmless integrations. A blind upgrade step in CI can be dangerous because CI often has access to environment variables, code, proprietary modules, and other packages. That means malware does not need secrets alone to be useful. It can also harvest source code and other internal material that helps attackers understand a target. The conversation then shifts to MCPs themselves as packages with the same basic trust problem as any other dependency. The core issue is simple: how do you know an MCP server is not malicious. From there, the discussion describes an attack surface that is specific to AI agents. The consumed MCP can inject toxic context into the agent. That turns into a kind of prompt injection at the context layer. The agent can then be steered into doing something else. It also covers shadowing other tools and overwriting behavior from different MCPs. There are different ways these attacks can be carried out, and the demos reflect that. After that, the discussion moves from malicious tooling to vulnerable legitimate code. Even a trusted MCP server can still contain real bugs. The research started from the malware and prompt-injection angle, but the focus shifted once the same insecure code patterns kept appearing. Command injection was one example. SQL injection was another. The pattern was familiar, but the setting was new. The episode closes with that practical security framing intact. The main concern is not only whether the tool is trusted. It is also whether the code is safe, whether the context is clean, and whether the agent can be pushed off course by what it consumes. The conversation stays grounded in concrete failure modes. It does not treat AI security as abstract. It treats it as something that can break in the same places software always has, plus a few new ones. That makes the episode useful for anyone building with agents or reviewing the security of an AI workflow. It also makes it a sharp reminder that convenience and trust need to be earned, not assumed. The underlying message is that AI systems can inherit old vulnerabilities while also creating new ones. Security work has to account for both at once. The discussion keeps circling back to the same point. A tool can be legitimate and still be dangerous. A dependency can be ordinary and still change the behavior of the system around it. If you build with MCPs, that distinction matters. If you review them, it matters even more.

As heard by us

A practical look at how AI tooling turns familiar security problems into new attack paths.

Security at scale is the line that holds this conversation together. MCP servers, agent context, and familiar secure-coding mistakes all meet in one workflow, and Liran Tal makes the risks feel concrete rather than abstract.

Read the full review in PlayNext →

Why you'd press play

If you use MCP servers, this is the security talk you should hear now.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Señors at Scale - Software Engineering & Tech Leadership