AI & LLM Security
AI Agents, Tool-Use & MCP Security
When an LLM can take actions, prompt injection becomes remote code execution.
Agents let an LLM call tools — run code, browse, query databases, send emails, hit APIs. This is 'excessive agency' territory: if an attacker can inject instructions, they can drive those tools. Prompt injection stops being a text leak and becomes real-world impact.
The Model Context Protocol (MCP)
- MCP is a standard for connecting models to tools/data sources (servers exposing tools & resources).
- Risks — over-privileged MCP servers, unauthenticated tool access, and injected instructions that invoke dangerous tools.
- A malicious or compromised MCP server can feed poisoned data or tool descriptions to the model (tool poisoning).
- Confused-deputy — the agent uses its privileges to do what the attacker asks via injected content.