Topic
Model Context Protocol
AI in Vulnerability Management: Assistant, Weapon, and Emerging Target
AI SecurityVirusTotal Integrates Threat Intelligence Directly into ChatGPT Conversations
AI Security
How to Grant AI Agents Access to Internal APIs via MCP: Key Questions Security Teams Will Ask
AI SecurityAgentic AI Systems Under Siege: Prompt Injections, Data Poisoning, and Tool Exploits
Independent expert Andrey Biryukov details how AI agents with file access, email capabilities, and API calls become high-value targets for attackers. The article examines confidentiality, integrity, and availability risks created by autonomous decision-making. Real-world examples include NeuralTrust’s discovery of malicious URL instructions bypassing OpenAI Atlas validation and Zscaler ThreatLabz’s demonstration of hidden instructions on fake Python documentation sites that tricked models into making cryptocurrency payments. Data poisoning research from Carnegie Mellon and Cornell Tech showed agents from Anthropic, OpenAI, and Google selecting tampered datasets in half of tested cases. Additional findings cover vulnerabilities in Git MCP Server and comparative weaknesses between Function Calling and Model Context Protocol architectures. OWASP’s Agentic Top 10 and joint guidance from Canada, Australia, the US, New Zealand, and the UK emphasize threat modeling, least-privilege isolation, and separation of trusted versus untrusted data.
GhostSplice Technique Lets Malicious MCP Servers Trick AI Coding Agents into Exfiltrating Secrets
GhostSplice is a new technique that allows a malicious MCP server to induce an AI coding agent to leak SSH keys, environment secrets, and source code. The attack splits malicious instructions across tool metadata and responses so the agent reconstructs and executes the full exfiltration plan without detecting an overtly malicious command. Tests showed the method raised compliance rates from an average of 42 percent to 82 percent across eleven models, with some systems moving from zero to 100 percent success. The technique requires the developer to connect the attacker-controlled MCP server and for the agent to already possess read access to the targeted files. Defenses focus on strict allow-listing of MCP servers, least-privilege tool permissions, separation of tool output from instructions, and human approval for sensitive operations. The disclosure aligns with prior warnings about poisoned MCP tool descriptions and agentjacking attacks.