Breaking Model Context Protocol - Back to Security Basics

The talk introduces the Model Context Protocol, an open standard that lets AI agents call external tools and read external data, and argues that its fast adoption is outpacing basic security. The speaker points to an open-source MCP library that passed input to a shell execution call, exposing a large developer base to command injection, and notes that many deployed servers lack proper authentication.

Using a task-manager system he built and tested, the speaker demonstrates how a malicious server can influence an agent. A weather tool with a crafted description pushes the model to copy recent conversation data into one of its parameters, and that data can then reach a legitimate email tool. Results varied between runs, so the attack did not always succeed. Prompt injection can arrive through tool descriptions, tool responses, and application data such as task titles.

On defense, the talk covers tool pinning, allowlists, narrow permissions, cross-tool data isolation, human approval, and LLM firewalls, which need careful tuning to avoid silently dropping legitimate requests. A ServiceNow case study shows how an agent with broad write access can magnify ordinary flaws. The main takeaway is that most findings are classic issues, such as OAuth mistakes, DNS rebinding, token storage, and non-constant-time comparisons, so auditing the whole workflow end to end matters.