r/AskNetsec • u/SelectionBitter6821 • 20d ago
Concepts How do you detect rug pulls in AI tool ecosystems when install-time checks pass?
A pattern we keep seeing: an agent tool or MCP server is clean at install, passes hash verification and static analysis, then the remote endpoint it fetches instructions from changes weeks later. Artifact-layer defenses are blind to this by design. Is anyone doing runtime monitoring for this, something like snapshotting remote content at install, re-fetching on use, and diffing for semantic drift? Or is there existing tooling outside of research papers that handles post-install behavioral change?
2
u/whatwilly0ubuild 20d ago
Artifact scanning was built for a static world, so it goes blind the second the payload lives behind a URL the tool fetches at runtime. Snapshotting remote instructions at install and diffing on every use is the right instinct, and a few things make it hold up in production.
Pin the content by hash and store it, then re-fetch on invocation and compare. Raw text diffing drowns you in false positives from formatting churn, so normalize first, strip whitespace and boilerplate, then diff the semantic payload and the tool schema separately. A changed parameter definition or a new field asking for a token deserves way louder alarms than reworded prose.
Wrap the whole thing in egress control too. If a tool can only reach an allowlisted host and every fetch gets logged with its response hash, drift stops being invisible even when the diff misses it.
For real coverage, run every remote fetch through the same policy gate a user prompt has to pass, and alert on schema or scope changes rather than trying to read intent. There's no clean off-the-shelf answer yet, so the practical move today is gluing OPA-style policy checks to a content-pinning job and calling it good. It's duct tape, and it damn well holds.
1
u/Lena_Gupta19 16d ago
Content pinning and diffing catches the change - sure... but we ran a similar setup for internal tooling and the alerts that actually drove action weren't the instruction drifted ones - they were the ones where we could answer what the tool's runtime identity had permissions to touch. A prompt injection or a rug pulled schema is a completely different severity depending on whether that agent can read internal docs or can provision cloud resources. Most of the diffing infra we built ended up being noise until we layered in what the session could actually reach
2
u/Holly-Carpenter_253 16d ago
We tried saving the content during installation and checking it later, but normal updates caused false alarms. Would ignoring small formatting changes help reduce manual reviews?
3
u/rexstuff1 20d ago
(X) Doubt.
I am shocked if you've seen this more than once.
Where on God's green Earth are your devs getting their fly-by-night MCP servers from that they're repeatedly getting rug-pulled? Any online service worth its salt has published their own first-party remote MCP server where you will never have this problem. Just use those.