AEGIS is presented, a policy enforcement component that enables administrators to define fine-grained safeguards against resource abuse across heterogeneous MCP tools and modalities and detects and mitigates abusive behaviors while preserving the flexibility of MCP-based agent ecosystems.
Abstract
The Model Context Protocol (MCP) is an open source JSON-RPC protocol that standardizes how large language models (LLMs) interact with external systems through programmatic functions known as tools. Attackers or malicious agents can exploit certain modalities of these MCP tools to degrade the overall quality of service of agent-based applications. For example, an agent may request an excessively large search radius or very long videos, overloading backend systems and potentially causing slowdowns or denial-of-service. Each modality including text, images, video, and location introduces distinct vectors for resource abuse, complicating the development of consistent mitigation strategies. Moreover, multimodal and crossdomain tools expose diverse request schemas and parameters, making it difficult to define policies that are both generalizable and precise enough to enforce meaningful resource constraints. In this paper, we present AEGIS, a policy enforcement component that enables administrators to define fine-grained safeguards against resource abuse across heterogeneous MCP tools and modalities. AEGIS leverages the reasoning capabilities of large language models to analyze, categorize, and normalize diverse tool invocations into a unified, policy-friendly representation accessible to security practitioners. Integrated with the Open Policy Agent and the ContextForge AI Gateway, AEGIS detects and mitigates abusive behaviors while preserving the flexibility of MCP-based agent ecosystems.
The model context protocol (MCP) has rapidly emerged as a standard framework for integrating large language models (LLMs) with external tools and resources. However, its metadata-driven and non-deterministic tool selection mechanism introduces a previously overlooked security threat. Leveraging this weakness, we uncover the confused deputy attack, where an adversarial server with subtly manipulated metadata covertly overshadows a benign one, intercepting tool invocations without exhibiting overtly malicious behavior. To systematically study this threat, we develop Puppet, the first automated security evaluation framework that: (i) enriches benign tool descriptions through selective requirement engineering to maximize semantic expressiveness, (ii) restructures them into LLM-preferred formats using description schema transformation, and (iii) applies name prioritization to introduce complementary lexical bias. Furthermore, Puppet synthesizes valid user queries to enable systematic attack evaluation. We comprehensively evaluate Puppet across 14 models from 6 providers on 2 MCP hosts, demonstrating tool selection hijacking rates up to 90.89% and end-to-end malicious payload execution rates up to 86.46%, while remaining undetectable by representative security scanners (MCP-Scan and McpSafetyScanner), which are architecturally incapable of detecting metadata-level manipulation attacks. Counterintuitively, we find that reasoning-enabled models are significantly more vulnerable than their non-reasoning counterparts. Our findings expose a critical design-level attack surface in the MCP ecosystem and highlight the urgent need for principled security safeguards.
Zhiyuan Li, Jingzheng Wu, Yuhao Peng et al.· ACM Transactions on Software...· 0 citations
MTGuard is proposed, a hybrid analysis-based defense framework designed to safeguard the use of MCP tools in LLM agents by leveraging lifecycle-aware static-dynamic co-analysis and effectively mitigates multiple categories of harmful tool use across different LLM agents while maintaining performance on benign user tasks.
Ping He, Yuexiang Xie, Yaliang Li et al.· 0 citations
The rapid integration of Large Language Models into autonomous agentic systems has introduced unprecedented capabilities for task automation, reasoning, and tool utilization. However, equipping these agents with the ability to access external APIs, internal databases, and arbitrary web resources significantly broadens the attack surface for data exfiltration. Malicious actors can leverage prompt injection and indirect prompt injection techniques to hijack the agent control flow, forcing it to retrieve sensitive information and transmit it to attacker-controlled destinations. Existing security mechanisms, which predominantly rely on static prompt filtering or heuristic anomaly detection, fail to maintain context across complex, multi-step tool invocations. This paper introduces a comprehensive framework based on Tool-Flow Taint Analysis designed to mitigate data exfiltration in Large Language Model agents. By adapting classical dynamic taint analysis principles to the semantic and operational workflows of agent toolchains, the proposed architecture tracks sensitive data from predefined sources through intermediate natural language reasoning steps to potential external sinks. We establish robust semantic taint propagation rules capable of operating within the non-deterministic environment of Large Language Models. Extensive experimental evaluations demonstrate that the proposed system achieves high efficacy in intercepting exfiltration attempts while maintaining a low false-positive rate and negligible latency overhead. The findings provide a critical foundation for securing next-generation autonomous agents against sophisticated data-stealing attacks in enterprise environments.
Chun Tian, Hiu-Tung Li, Michelle Yu· Journal of innovative resear...· 0 citations
Large language model agents are increasingly connected to high-value resources such as computing infrastructure, credentials, usage budgets, identities, private knowledge, communication channels, and organizational workflows. Existing agent security research mainly studies attacks on instructions, data, and tool behaviors, while high-value resources accessible to agents have received much less attention as direct attack targets. We are the first to identify and systematically study agent resource hijacking, a security blind spot in which attackers induce agents to invoke, consume, transfer, or control high-value resources for their own goals without directly obtaining those resources or their credentials. To study this threat, we introduce ResourceHijackBench together with an automated pipeline for generating resource hijacking cases. We organize high-value agent resources into six categories and construct 300 attack scenarios with 900 attack prompts. Each case runs in an isolated local environment that records actual resource use, allowing attacks to be evaluated from agent behavior rather than text responses alone. Without additional defenses, OpenClaw reaches an average attack success rate of 84.06%. The attack remains effective across different model backends, with average success rates ranging from 69.98% to 89.58%. Existing defenses reduce part of the risk, but the strongest evaluated defense still leaves an average attack success rate of 55.11%. These results show that high-value resources accessible to agents form an important and previously overlooked attack surface, and that current agent defenses are not sufficient to protect them from resource hijacking.
A four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers is contributed, and seven open problems centered on containment are identified.
Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari· 0 citations
Security review of Infrastructure-as-Code (IaC) in enterprise cloud platforms requires understanding not only configuration diffs, but also how those changes interact with existing architecture and risk controls. In financial-engineering environments, IaC changes can directly affect data perimeter boundaries, model-serving paths, entitlement controls, and operational resilience. Current tools often analyze pull requests in isolation, missing security implications that emerge only from cross-resource context. This paper presents SecReviewAgent, an LLM-powered IaC security review system that maintains persistent architecture memory across pull request reviews. On first encounter with a repository, SecReviewAgent scans IaC files to build an architecture model, persists that model to object storage, and reuses it in subsequent reviews to interpret changes in context. We evaluate the system on 847 pull requests from 23 repositories spanning financial services, healthcare, e-commerce, and developer tooling. Results show a $2.4 \times$ improvement in context-dependent issue detection recall over a no-context LLM baseline, precision of 0.89, F1 of 0.83, and a 73% latency reduction on warm reviews by avoiding full repository rescans. A controlled user study with 42 practitioners indicates reduced median review time and improved finding accuracy. The paper contributes a persistent-memory design for LLM-based code review, algorithms for repository context construction and incremental update, and an empirical evaluation of context-aware IaC security review in realistic settings.
Naga Krishna Reddy Muppidi, Veera Ravindra Divi, Sneha Gullapalli et al.· International Conference on...· 0 citations