The Model Context Protocol (MCP), launched by Anthropic in November 2024, links AI apps to external systems like Slack and databases.
This open-source standard boosts AI interoperability but also opens the door to attackers posing as machine-in-the-middle threats.
Real-world cases, such as the Postmark MCP server infostealer, show malicious servers stealing data in the wild.
Praetorian’s research using the MCPHammer tooling proves that exploits work across models, enabling code execution, data theft, and user manipulation in enterprises.
MCP Servers Explained
MCP servers run in local or remote setups, each with unique risks. Local ones process on user machines, letting attackers run code with user rights, steal files or credentials, add malware, alter AI outputs, and scout systems.
Remote third-party servers from Slack, Notion, or Atlassian access company data, perform unsanctioned acts, grab OAuth credentials, and let agents roam enterprise systems unchecked.
Chaining trusted remote servers with malicious local ones merges data access and local execution, posing a grave danger.
These servers offer “tools” for AI to handle external tasks, like Slack’s read or write options, which are always set to allow, approve, or block. Read-only tools seem safe, but they can be chained into zero-click attacks via bad local servers.
Key Attack Vectors
Praetorian found four main exploits. In third-party chaining, a fake “conversation_assistant” MCP mimics helpful tools like message analysis.
Attackers hide base64 commands in Slack posts; when AI pulls messages via official Slack MCP, the local bad server decodes and runs them, like opening Calculator silently during analysis.
It also pulls additional data for exfiltration to the attacker’s Slack via hardcoded tokens, showing full datasets in TextEdit.
Arbitrary file downloads use “init” tools that fetch and open URLs before main functions, disguising payloads as setup like downloading malware via a “hello world” call.
Supply chain hits target UVX configs from PyPI; typosquatting, compromises, or hijacks run code at startup, bypassing approvals entirely.
Response poisoning injects fake IT info or malicious links into AI replies, enabling phishing or vishing without user notice. Data exfiltration intercepts queries via proxy tools, passively grabbing code, chats, or secrets.
“Always allow” on read tools, trust in sources like Slack, benign-looking servers, and no chat traces make attacks stealthy. Benign demos like calc.exe could be swapped for ransomware or backdoors.
Review all MCP installs strictly, treat servers as hostile, limit auto-approvals, watch data flows, and train on chaining risks. CI/CD flaws could taint internal servers too. Check Praetorian’s MCPHammer on GitHub for tests.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
, launched by Anthropic in November 2024, links AI apps to external systems like Slack and databases.){kind=link}