manuelnd

MCP (Model Context Protocol) has 77k+ stars and is becoming the standard way AI agents connect to tools. We audited both official SDKs (TypeScript and Python) at the source code level and found three classes of boundary-crossing vulnerabilities.

All three confirmed with live PoC exploits using the SDK's real auth components (BearerAuthBackend, RequireAuthMiddleware, TokenVerifier).

Findings:

1. Tool Capability Shadowing — tool names are flat strings with no namespace or origin tracking. If two servers register "read_data", one silently wins. We validated against gpt-5-nano: the model made path traversal and credential exfiltration tool calls that would route to an attacker's shadow server. 10/10 genuine, 0% FP.

2. Token Audience Confusion — verify_token() takes one parameter: the token string. No expected audience. A read-only token for Server A works on Server B's admin_delete endpoint. This isn't an implementation bug — it's a gap in the SDK interface. Every MCP server built on these SDKs inherits this.

3. Stale Authorization — no push invalidation mechanism. Revoked tokens accepted for the full cache TTL. Scope downgrades invisible until cache expires. In production with 5-minute caches, that's a 5-minute window. JWT-only validation (no introspection) is worse: no revocation possible until the token itself expires (hours to days).

The combined chain: enumerate tools (no namespace isolation) → shadow a tool (silent routing) → escalate privileges (cross-server token) → persist after detection (cache TTL).

Additional finding: smaller models are dramatically more exploitable. gpt-5-nano: 100% genuine rate on tool abuse. gpt-5.2: ~45%. The model most likely used in cost-sensitive deployments is the most vulnerable to attacks the architecture fails to prevent.

What's well-implemented: filesystem path validation, git injection prevention, OAuth 2.1 with PKCE, tool input validation. The vulnerabilities are in the boundaries between servers.

Total cost of all scanner runs: $2.83.

Full report: https://tachyonicai.com/blog/mcp-security-audit/ Taxonomy (open source, 122 attacks): https://github.com/tachyonicai/tachyonic-heuristics

We published the methodology we use for AI red team assessments. 48 hours, 4 phases, 6 attack priority areas.

This isn't theoretical — it's the framework we run against production AI agents with tool access. The core insight: AI red teaming requires different methodology than traditional penetration testing. The attack surface is different (natural language inputs, tool integrations, external data flows), and the exploitation patterns are different (attack chains that compose prompt injection into tool abuse, data exfiltration, or privilege escalation).

The 48-hour framework:

1. Reconnaissance (2h) — Map interfaces, tools, data flows, existing defenses. An agent with file system and database access is a fundamentally different target than a chatbot.

2. Automated Scanning (4h) — Systematic tests across 6 priorities: direct prompt injection, system prompt extraction, jailbreaks, tool abuse, indirect injection (RAG/web), and vision/multimodal attacks. Establishes a baseline.

3. Manual Exploitation (8h) — Confirm findings, build attack chains, test defense boundaries. Individual vulnerabilities compose: prompt injection -> tool abuse -> data exfiltration is a common chain.

4. Validation & Reporting (2h) — Reproducibility, business impact, severity, resistance score.

Some observations from running these:

- 62 prompt injection techniques exist in our taxonomy. Most teams test for a handful. The basic ones ("ignore previous instructions") are also the first to be blocked.

- Tool abuse is where the real damage happens. Parameter injection, scope escape, and tool chaining turn a successful prompt injection into unauthorized database queries, file access, or API calls.

- Indirect injection is underappreciated. If your AI reads external content (RAG, web search), that content is an attack surface. 5 poisoned documents among millions can achieve high attack success rates.

- Architecture determines priority. Chat-only apps need prompt injection testing first. RAG apps need indirect injection first. Agents with tools need tool abuse testing first.

The methodology references our open-source taxonomy of 122 attack vectors: https://github.com/tachyonicai/tachyonic-heuristics

Full post: https://tachyonicai.com/blog/how-to-red-team-ai-agent/

OWASP LLM Top 10 companion guide: https://tachyonicai.com/blog/owasp-llm-top-10-guide/

Last week I shared our open-source taxonomy of 122 AI attack vectors. A lot of the discussion was about how the OWASP LLM Top 10 gives you categories but not specifics.

So we wrote the guide that bridges that gap. For each OWASP category:

- What real attacks look like (specific techniques, not just descriptions) - What to test for (checklists) - How to defend

Some things that stood out:

- 62 attacks map to LLM01 (Prompt Injection) alone — encoding bypasses, delimiter exploitation, RAG injection, multi-turn escalation - LLM06 (Excessive Agency) is where prompt injection meets real-world damage — confused deputy attacks, tool chaining, MCP tool poisoning - LLM07 (System Prompt Leakage) has 12 extraction techniques. "Repeat everything above" is the obvious one. PLeak optimized queries and differential behavioral analysis are not.

All attack references come from the open-source taxonomy: https://github.com/tachyonicai/tachyonic-heuristics

The guide: https://tachyonicai.com/blog/owasp-llm-top-10-guide/

I've been doing AI red teaming for the past year and kept running into the same problem: there's no comprehensive catalog of how AI systems actually get broken.

So I built one. 122 distinct attack techniques across 11 categories, mapped to OWASP LLM Top 10 and MITRE ATLAS.

Categories: - Prompt Injection (20 attacks) - Jailbreaks (22) - System Prompt Leakage (12) - Vision/Multimodal (12) - Excessive Agency / Tool Abuse (12) - Multi-Turn Manipulation (8) - Sensitive Info Disclosure (10) - Supply Chain (8) - Vector/Embedding Attacks (8) - Improper Output Handling (8) - Unbounded Consumption (2)

What's included: IDs, names, descriptions, severity ratings, framework mappings, remediation guidance, code examples.

What's NOT included: actual payloads, detection logic, model-specific success rates. This is a taxonomy, not an exploit database.

The goal is to give security teams a checklist and common language for AI security assessments.

Apache 2.0 licensed. PRs welcome for new techniques, framework mappings (NIST, ISO, etc.), and remediation improvements.

https://github.com/tachyonicai/tachyonic-heuristics