Snyk Engineer Silverman Explains MCP Security: Distinguishing Malicious Tool Descriptions from Code Vulnerabilities, Demonstrating Figma Injection Attack

In a video course at the AI Engineer conference, Snyk security engineer Micah Silverman detailed core mechanisms for AI application security. He used a student chatbot as a 'capture the flag' exercise, noting that when the model refuses to reveal grades, the refusal itself exposes its access to that data. Silverman argued that relying solely on system prompts to keep data private is insufficient because the data remains within the model's available context; instead, architectural measures like restricting database views are necessary to remove the model's access to sensitive information entirely.

Regarding the popular Model Context Protocol (MCP), Silverman proposed a specific security analysis methodology. He distinguished between 'malicious tool descriptions' and 'ordinary code vulnerabilities,' recommending pairing agent scans with dependency and source code analysis. To illustrate the practical impact of this distinction, he cited a command injection case in a Figma MCP server. This example showed how attackers could exploit instructions within tool definitions to execute unauthorized operations, a risk distinct from traditional code logic errors that leverages the AI agent's trust boundary regarding tool descriptions.

The course also covered OWASP risks, shadow AI, threat modeling, and red teaming. Through a live EVO demonstration, Silverman showed how to inventory models, datasets, and MCP servers, then add policies to immediately flag prohibited models already present in a project. He extended this inventory into proposed build gates and reviewed how threat modeling must adapt when prompts, retrieved content, and generated outputs cross trust boundaries. For engineers working on agentic development, this methodology offers a concrete path from traditional application security controls to addressing AI-specific risks.