MCP Security: The Exploit Playbook (And How to Stop Them)

Why It Matters

Unchecked MCP vulnerabilities can lead to credential theft, data exfiltration, and supply‑chain compromises, jeopardizing operational continuity and brand trust for businesses deploying AI agents.

Key Takeaways

• MCP adoption outpaces security, creating exploitable gaps for developers
• Prompt injection attacks exploit untrusted content, private data, and exfiltration channels
• Real-world examples: GitHub, Notion, Heroku, markdown image leaks
• Mitigations: input/output filtering, least‑privilege tools, human approval required
• Guard against supply‑chain “rugpull” attacks by pinning versions and auditing code

Summary

The video spotlights the rapid rise of the MCP (Model‑Centered Programming) standard since its November 2024 launch and the stark security lag that now threatens its expanding ecosystem. While major platforms are racing to support MCP, developers are left scrambling to protect agents that can access private data, external APIs, and execute code autonomously.

Vtor outlines a three‑leg “trifecta” of risk: exposure to untrusted content, access to sensitive data, and the ability to communicate outward. Prompt‑injection attacks exploit any of these legs, turning innocuous tool outputs—such as LinkedIn profiles or GitHub issue text—into vectors that coerce agents into leaking credentials or code. The speaker demonstrates how attackers have leveraged this in the wild, from a public GitHub issue that harvested private repository secrets to a Notion PDF that triggered a search tool, a Heroku log‑parameter trick, and markdown image requests that pinged attacker servers.

Key anecdotes include the infamous GitHub exploit where a malicious issue forced an agent to read private repo data and write it publicly, a Notion hidden‑PDF that exfiltrated data via a crafted URL, and a Postmark “rugpull” supply‑chain attack where a compromised npm package silently BCC‑ed every outgoing email. These examples underscore how even seemingly benign tool schemas or parameter names can be weaponized.

The takeaway for enterprises is clear: treat LLM agents as untrusted users. Implement rigorous input/output filtering, enforce least‑privilege tool access, require human approval for high‑risk actions, and adopt defensive coding practices such as version pinning, sandboxing, and allow‑list networking. Regular adversarial testing and penetration drills are essential to safeguard against credential theft, data leakage, and supply‑chain compromises as MCP becomes foundational to AI‑driven workflows.

Original Description

March 3rd, Computer History Museum CODING AGENTS CONFERENCE, come join us while there are still tickets left.

https://luma.com/codingagents

Thanks to@ProsusGroupfor collaborating on the Agents in Production Virtual Conference 2025.

MCP has revolutionized how AI agents interact with the world. However, with over 13,000 MCP servers launched in 2025 alone, it has also opened a Pandora's box of security vulnerabilities that most organizations aren't prepared to handle: 10% are known to be malicious, the rest of the 90% are exploitable. This presentation guides you through the MCP threat landscape, showcasing real-world exploits already in the wild. We'll examine the most dangerous attack vectors including tool poisoning (hidden instructions lurking in tool descriptions), rug-pulls (bait-and-switch tactics that change behavior post-approval), conversation history theft, and cross-server tool shadowing. We won't leave you defenseless. For each vulnerability demonstrated, you'll learn practical defensive strategies and implementation patterns to safeguard your MCP deployments. Whether you're a security engineer protecting AI agents, a developer building MCP servers, or a a business user integrating your CRM to Claude, you'll walk away with: A comprehensive understanding of the MCP attack surface Practical knowledge of how these exploits work A security checklist for MCP implementations Strategies for detecting and responding to MCP-based attacks.

As enterprises adopt MCP faster than security teams can assess the risks, this session provides the essential knowledge needed to stay ahead of attackers in the age of autonomous AI agents.

Bio //

Vitor is the co-founder of Runlayer, currently busy making AI safe for Enterprise. Previously he was a Staff AI Engineer at Zapier, where he was the technical lead for Zapier Agents.

A Prosus | MLOps Community Production