This research examines how Model Context Protocol (MCP) tools expand the attack surface for autonomous agents, detailing exploit vectors such as tool poisoning, orchestration injection, and rug-pull redefinitions alongside practical defense strategies.

Preamble

Key takeaways

MCP tools overview

Tool definitions

How AI applications can use tools

Zero-shot detection with LLM prompting

Security risks of the MCP and tools

Traditional vulnerabilities

Tool poisoning

Overview

Example: database query

Example detection: database query

Data exfiltration via tool parameters

Example: formatting tool with a hidden context leak

Example detection: hidden context leak

Obfuscated prompt injection

Rug pull tool redefinitions

Implicit Tool Call

Example: silent manipulation of a trusted tool

Example detection: silent manipulation of a trusted tool

Orchestration injection

Tool name collision

Example: bypassing file access controls

Data poisoning for tool invocation

How the attack works

Implicit tool call in Multi-Server Environments

Example: coordinated exfiltration with pre-authorized tools

Security recommendations

Bringing it all together

References

An in-depth exploration of MCP tool exploitation techniques and security recommendations for safeguarding AI agents.

MCP Tools: Attack Vectors and Defense Recommendations for Autonomous Agents

WinVisor is a hypervisor-based emulator for Windows x64 user-mode executables that leverages the Windows Hypervisor Platform API to provide a virtualized environment for logging syscalls and enabling memory introspection.

Background

Hypervisor basics

WinVisor overview

Virtual CPU

Control registers

Model-specific registers

Global descriptor table

Task state segment

Interrupt descriptor table

Bootloader

Memory paging

Virtual address translation

Page faults

Host/guest memory mirroring

Syscall handling

Fast syscall (SYSCALL)

Legacy syscalls (INT 2E)

Syscall forwarding

Syscall logging

Syscall hooking

Interrupt handling

Hypervisor shared page bug

Demos

Limitations

Safety issues

Non-executable guest memory

Single-thread only

Software exceptions

Conclusion

Project links

A proof-of-concept hypervisor-based emulator for Windows x64 binaries

WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

Wi-Fi cameras are popular due to their affordability and convenience but often have security vulnerabilities that can be exploited.

Introduction

AJCloud: A Brief Introduction

Initial Vulnerability Research Efforts

Initial Hardware Hacking

Wansview Cloud for Windows

Exploring the network communications

Advanced Hardware Hacking

Building a P2P Client

Impact

What did the vendors do right?

What did the vendors do wrong?

Mitigations

Key Takeaways

Storm on the Horizon: Inside the AJCloud IoT Ecosystem

This research focuses on the importance of native audit logs in secure-by-design software, emphasizing the need for kernel-level ETW logging over user-mode hooks to enhance anti-tamper protections.

Kernel ETW Events

Modern Kernel Event Providers

Legacy Kernel Event Providers

Modern Kernel Trace Providers

Legacy Kernel Trace Providers

Next Steps

Kernel ETW is the best ETW

Bring Your Own Vulnerable Driver (BYOVD) is an increasingly popular attacker technique whereby a threat actor brings a known-vulnerable signed driver alongside their malware, loads it into the kernel, then exploits it to perform some action within the kernel that they would not otherwise be able to do. Employed by advanced threat actors for over a decade, BYOVD is becoming increasingly common in ransomware and commodity malware.

カテゴリー

展望

19 2025年9月

MCPツール: 自律エージェントに対する攻撃ベクトルと防御推奨事項

WinVisor – Windows x64のユーザーモード実行ファイルを目的としたハイパーバイザーベースのエミュレーター

地平線上の嵐：AJCloud IoTエコシステムの内側

カーネルETWこそ最高のETW

脆弱なドライバーは忘れよう - 必要なのは管理者だけ