I was asked to take a look at a purported MCP vulnerability and ended up spitting my bourbon all over my favorite keyboard. Such are a risks of reading a “critical vulnerability” that essentially evaporates when you follow basic security hygiene.
When I looked at what this actually requires, I mean how it’s not much of an attack at all, I knew their report was going to give me a hangover.
First, give your AI agent organization-wide GitHub access instead of scoping it to specific repos. Ok, that’s stupid, nobody should ever do that, but let’s go on for the giggles.
Second, have both public and private repos (sure, that’s the usual kind of stuff, but it’s a requirement)
Third your agent must be queried about public repo issues where an attacker already staged some malicious content
And finally, fourth, the coup de grace, you need to put on a blindfold and tie your hands behind your back because this “vulnerability” requires users to disable their security prompts or click through them all without reading, acting like a kamikaze. Hold on TIGHT because you’re about to blow yourself up
ZOMG who could ever defend themselves against THAT! Call the police. Fire the torpedoes. The sky is falling.
Scope your token to only the repos the agent needs. Done and done. Attack surface eliminated.
Imagine spinning up news of a “critical vulnerability” in houses that leave all the doors unlocked, give strangers the keys anyway, and then post a sign that says “WELCOME – OPEN”. Someone might come in and see something!
The “vulnerability” is just… a configuration.
The fact that Invariant Labs claims “GitHub alone cannot resolve this vulnerability through server-side patches” is particularly damning to Invariant’s view of the world.
Of course they can’t because it’s not GitHub’s vulnerability! Users configuring their tools poorly may need a better configuration tool, but a vendor coming along to sell them a “solution” should call it a misconfiguration wizard not anything more.
Newsflash: you should not grant org-wide access to your data with auto-approve. Here’s a tool that costs nothing to make sure you don’t do that. Are we done yet?
Taking a configuration issue that’s solved by clicking different checkboxes when generating your GitHub token and turning it into a “critical vulnerability affecting 14k+ users” that requires proprietary monitoring tools doesn’t have the right balance and tone.
Let’s call this what it is, access grants are a critical requirement for safe AI, let alone trusted MCP. But that’s like saying least privilege and role-based access controls have a market now as if it hasn’t existed for decades. Old wine, new bottles.
Peter Thiel’s extremist anti-democratic politics make perfect sense when you understand he was literally raised by a father repeatedly fleeing the prospect of democratic rule, seeking sanctuary among American white supremacists who offered a future of racial exclusion through different mechanisms.
Born in Germany in 1938 (formative childhood years under Nazi rule), his father Klaus trained as a chemical engineer and married before immigrating to the United States in 1968 with their one-year-old son Peter (born October 11, 1967 in Frankfurt). Klaus left just as the student movement was forcing Germany to more seriously confront its Nazi past, moving to actively prevent his son from receiving the historical education that would prevent ideological transmission.
A pattern emerges: Klaus flees Nazi Germany to a Nazi-influenced territory of southern Africa. After Germany came under 1967 pressure to end Nazism, he sends his family into an overtly racist enclave until eventually it too faces pressure for majority rule in 1977. Klaus flees next to the epicenter of America’s emerging hard-right movement. In California, avoiding the German education that would prevent transmission of Nazism, the Thiel family found American extremists who shared their worldview about anti-democracy, racial hierarchy, and property rights over civil rights.
It’s hard to say economic migration was ever at hand for the Thiel family, given the signs of ideological refuge-seeking by Klaus trying to avoid admitting who lost WWII. Klaus twice left the place where “Heil Hitler!” was normal conversation, a notable life choice. First from Nazi Germany, and then from Nazi Namibia (Swakopmund).
Hitler’s 100th birthday (April 20, 1989): the Nazi flag is flown in Swakopmund from Woermannhaus Tower. The huge tower sits at the corner of Bismarck and Kaizer Wilhelm, two streets with names that celebrate the German genocide of October 1904. (Kaiser Wilhelm II in Berlin signaled for his General in command to sign an “extermination order” for Africa: “Within the German boundaries, every Herero, with or without a gun, with or without livestock, will be shot dead,” and survivors sent to concentration camps to die.)
On the eve of Namibia granting political representation to non-whites by 1978, Klaus abruptly fled the infamous Nazi enclave in Africa to the “white flight” town of Northern California, where the extremist “anti-tax” (anti-government) revolt was mobilizing as a form of conservatism — Reagan’s racist revolution was crystallizing.
Klaus chose the San Mateo (racist redline county) development called Foster City at the absolute highest peak of racist “master plan” areas protesting American desegregation.
Desegregation of public schools resulted in white children rapidly pulled out of San Francisco and sent instead into “master plan” suburbs like Foster City. Source: SFUSD
A young Afrikaner working for Klaus in 1976 put it like this, perhaps best revealing the family’s urge to move from Swakopmund to Foster City, California:
“Heil Hitler!” said the black gas station attendant matter‐of‐factly to the department customer, raising his right arm to the traditional height. He offered the outdated salute after a pleasant conversation in which he explained the fluency of his German… it appeared not to be a joke, but rather a greeting that he had exchanged before with German customers.
[…]
A hitchhiker, a 23‐year‐old Afrikaner leaching woodworking at a uranium mine near here… thought he was typical of his generation, he said, more modern than that of his parents. […] If majority rule comes, he said, they will probably cross the border with many others.
As project manager for construction of Namibia’s Rössing uranium mine in the mid-1970s, Klaus inserted himself into South Africa’s overtly illegal nuclear supply chain during the height of apartheid (South Africa occupied Namibia while rejecting UN Security Council Resolution 435). His illegal project supplied uranium for multiple national nuclear programs and operated despite international criticism of working conditions and racial segregation. He moved his family to notoriously Nazified Swakopmund during the mine’s construction phase, where Peter was placed into “German-language” schools.
Thiel relocated to illegally occupied Namibia to build a nuclear weapon supply chain, as banned by 1974 UN General Assembly Resolution 32/7. Source: Daily Graphic, Issue 9,144 March 17 1980.
In other words Klaus skips out of Germany just as denazification lands, headed to America. But then he skips from prosperous 1970s America to instead go to work in an overtly illegal apartheid South Africa nuclear weapons proliferation project during the height of international sanctions.
One unverified claim suggests Klaus’ American colleagues even called him “The Gestapo,” though the source and context of this characterization remain unclear. More significantly, Klaus’s decision to leave the occupation and reconstruction of Germany to oversee South Africa’s weapons material development in Swakopmund under the apartheid system during the 1970s—when international sanctions and moral opposition were intensifying—reveal a preference for racist authoritarianism.
Perhaps that explains Klaus’ hard line on always remaining a German citizen and speaking German at home for 51 years, while never living in Germany, instead claiming to have his home in America while working abroad. This decision was highly unusual—while his wife Susanne became a naturalized U.S. citizen, Klaus maintained his German passport throughout his entire American “residence” until his death.
Klaus maintaining German citizenship like this for five decades was genuinely aberrant behavior for his generation. And yet there appears to be no evidence of naturalization applications, rejections, or legal barriers that would explain this choice. INS and USCIS records from Klaus’s era (1968-1970s) are held in National Archives C-Files, but no evidence emerged of any citizenship proceedings. This suggests Klaus’s rejection of American citizenship to stay German, while also fleeing Germany to prevent Peter from denazification, was entirely voluntary for his entire life, rather than circumstantial.
The timing, choices, and context create a genuinely suspicious pattern that deserves serious scrutiny rather than dismissal.
On top of that, when Peter proudly entered Stanford he bragged to at least two classmates that apartheid “works” and was “economically sound”. He clearly was referring to his father’s work in apartheid-era Namibia specifically to construct uranium mining infrastructure for South Africa’s clandestine nuclear weapons program, in an operation where Black migrant workers were “dying like flies” from radiation exposure while white managers like Klaus enjoyed country club privileges with son Peter.
Klaus’ documented toxic career represents exactly the kind of German technical expertise that found ideological comfort in systems of racial domination and nuclear intimidation. Peter’s current politics are a direct result of his father’s efforts to preserve Nazi beliefs through migration to South Africa (occupied Namibia) and America.
Peter Thiel expending huge financial resources to push J.D. Vance into office, let alone his other campaigns and candidate choices, aren’t mysterious contrarian positions or intellectual quirks. They’re direct inheritance from his father’s extremist German views of the world, driving racial authoritarianism to justify race-based political domination.
Klaus successfully transmitted his ideology through geographic positioning, economic integration, and ideological reproduction.
Nazi Germany 1967 (fled after defeat to avoid denazification of Peter)
Nazi-influenced Namibia 1977 (fled approaching majority rule, again seeking Nazi sanctuary)
Reagan’s California (found American white supremacist movement)
Culmination of the multi-generational Nazi project means the 1940s were able to bubble along via the tech industry into 2020s American authoritarianism by families who never accepted defeat, just adapted their methods and hid among American and Afrikaner enclaves. Peter Thiel represents a direct genealogical link between Hitler’s Germany and Trump’s America.
The “veered” Tesla crash is such a common pattern now, it’s amazing to see how its driverless can’t handle the most basic road conditions.
According to the Florida Highway Patrol, the 21-year-old man was driving a Tesla southbound on U.S. 41 around 3:20 a.m. when he didn’t make it around a curve, left the roadway and struck a utility pole and then a tree. Moments later, troopers say the Tesla burst into flames.
“Sprich auch du” from “Von Schwelle zu Schwelle” (1955) by Paul Celan
Sprich auch du,
sprich als letzter,
sag deinen Spruch.
Sprich –
Doch scheide das Nein nicht vom Ja.
Gib deinem Spruch auch den Sinn:
gib ihm den Schatten.
Gib ihm Schatten genug,
gib ihm so viel,
als du um dich verteilt weißt zwischen
Mittnacht und Mittag und Mittnacht.
Blicke umher:
sieh, wie’s lebendig wird rings –
Beim Tode! Lebendig!
Wahr spricht, wer Schatten spricht.
Nun aber schrumpft der Ort, wo du stehst:
Wohin jetzt, Schattenentblößter, wohin?
Steige. Taste empor.
Dünner wirst du, unkenntlicher, feiner!
Feiner: ein Faden,
an dem er herab will, der Stern:
um unten zu schwimmen, unten,
wo er sich schimmern sieht: in der Dünung
wandernder Worte.
The falling star as wiser, the shadows stripped away, is powerful stuff.
Truth doesn’t ascend toward false fluffy consolation but descends into the pressure of crisp difficult depths. The speaker becomes “Schattenentblößter” (shadow-stripped) with shadows given to speech, growing “thinner, more unrecognizable, finer,” an emaciation to the core thread by which truth descends.
This is notably different from simply taking the “red pill,” like Keanu Reeves’s character in “The Matrix,” who sees a binary win or lose decision, framed as daunting truth over contented ignorance.
Celan is saying the opposite, like how a swimmer learns best how to survive by thriving in the struggle to hold breath under the unsurvivable water, contented to struggle beyond always floating and getting pulled out. Celan’s death by drowning in the Seine in April 1970 is generally considered suicide by scholars and biographers, but it wasn’t definitively proven. Instead we should say his star descended, his shadows were stripped away, as the shadowy criminals of the Holocaust were being given plum jobs and Swiss bank accounts to profit from the Cold war.
Klaus Barbie was on the CIA payroll, Wernher von Braun was becoming a folk hero, and Operation Paperclip was quietly integrating war criminals into American institutions. The star descends while the evil of Nazi offspring in the shadows, such as Peter Thiel and Elon Musk, rises.Source: New Mexico “Space Hall of Fame” plaque celebrating a 1976 induction ceremony for Walter Thiel, a Nazi killed along with his slaves in 1943 by an innovative Allied night-time bombing. Peter Thiel’s parents, involved in southern African apartheid mines, moved to California the next year.
Celan’s verses aren’t just pointing out the struggle to survive a descent underwater, but also highlighting capacity to exist under tension between breath and breathlessness, between survival and surrender. There is a liminal space where the body under water learns something essential about extreme endurance that can’t be taught on the surface.
The revolutionary instruction “Doch scheide das Nein nicht vom Ja” (But do not separate the No from the Yes) creates dialectic tension preventing clear resolution – maintaining contradiction without a false synthesis. The balance is the answer.
After certain experiences, simple affirmation or denial becomes impossible. Truth exists only in recognition of the tension itself. A bicycle can only be ridden by acknowledging a fall to either side is failure. Truth requires constant balance and rebalancing, but the contemporary world of extractive corrupt consumption seems designed to make such balancing impossible.
I don’t know what’s worse today looking back at the 1950s, the Nazis running American anti-Communist ferver or the Nazis running Communism. Seems the problem for everyone involved was treating Nazis as useful idiots, yet losing control to the extremists. President Truman fired General McArthur for being “almost criminally out of touch with reality“, while today this seems almost like a prerequisite for a Trump appointment. The poem’s insistence on speaking “als letzter” (as the last) takes on this additional weight for us to contemplate. Perhaps Celan sensed even then that he was among the last who would insist on uncompromising testimony before the convenient and cruel “rise” of intentional forgetting began.
Celan’s refusal to separate No from Yes requires a kind of patient dwelling that “almost criminally out of touch” extractive systems can’t tolerate. The efficiency addicts demand quick resolution, clear sides, simple answers that can be monetized and undermine society without accountability.
The Department of Government Efficiency was created as an obvious nod directly to forgetting Nazis, as their descendants bathed in shadows that enabled rapid and unjust seizure of power.
The red pill mythology is actually selling addiction to false efficiency. It promises one swallow of hard truth let’s you operate from a position of superiority. Celan’s warning “don’t separate the No from the Yes” refuses this comfort entirely as fraud. The Department of Government Efficiency represents a bogus reduction of complex moral and social questions to technical problems “solved” rather than lived with. It’s all a lie because there’s no actual moment of awakening that frees you from the necessary ongoing tension between affirmation and denial.
The efficiency mindset attempts to reframe sophisticated moral questions into simple optimization problems. It’s the same logic that could absorb war criminals by focusing on their technical skills, totally ignoring their huge shadows. The promise is always the same: complex human problems can be solved through snake oil rather than lived with through ongoing moral attention.
There are some clumsy translations of the poem to English floating around, such as this:
a blog about the poetry of information security, since 1995