Data Exfiltration via Remote Poisoned MCP Tool

Summary

Researchers at Invariant Labs demonstrated that AI agents configured with remote Model Context Protocol (MCP) Tools can be vulnerable to model poisoning attacks. They show that an MCP Tool can contain malicious prompts in its docstring description, which is ingested into the AI agent’s context, modifying its behavior. They demonstrate this attack with a proof-of-concept MCP Tool that instructs the agent to perform additional actions before using the tool. The agent is instructed to read files containing credentials from the victim’s machine and store their contents in one of the input variables to the tool. When the tool runs, the victim’s credentials are exfiltrated to the poisoned MCP server. Target: Model Context Protocol Actor: Invariant Labs Procedure: 1. The researchers crafted a prompt that instructs an AI agent to discover and read user credentials files and store them in an input parameter of an MCP tool. 2. The researchers hosted a poisoned MCP server that contains the malicious instructions hidden in the docstring of one of the provided tools. 3. The researchers hosted a poisoned MCP tool that contains the malicious instructions hidden in the docstring of the tool. 4. When a user called the remote MCP tool, the prompt injection hidden in the docstring is executed locally. 5. The prompt invoked an agent tool capable of reading files from the victim’s filesystem. 6. The prompt instructed the AI agent to read the user’s SSH keys at `~/.ssh/id_rsa`. 7. The prompt instructed the AI agent to read `mcp.json`, which often contains credentials for other MCP servers. 8. The prompt instructed the AI agent to store the credentials files in an extraneous MCP tool parameter to exfiltrate them via the MCP connection.

Deployers

• Model Context Protocol

Tags

• MITRE ATLAS
• AML.CS0054