独立研究者发现MCP信任缺口可让智能体传播恶意指令
MCP for agent-to-agent comms may be the riskiest protocol you've never heard of
评分 57
导读
独立研究者 Syed Anas Mohiuddin 测试了谷歌、摩根大通、Rapid7、法国政府跨部门数字事务机构及美国联邦政府等机构的智能体，发现 MCP 的信任缺口可被一种针对智能体的提示注入利用，使被攻陷的智能体向内部其他智能体传播恶意指令。过去五个月，谷歌等五家组织已承认存在此类漏洞；攻击不直接针对 LLM，而是利用下游智能体对上游智能体的信任。
推荐理由
材料披露攻击者利用MCP信任缺口，让一个智能体向其他内部智能体传播恶意指令，并列出多家被测试机构。
主体与标签
MCPGoogleJP Morgan ChaseWeaviateRapid7#安全/对齐#Agent#MCP/工具调用
正文
The adoption of AI agents in millions of organizations is creating new opportunities for attackers to make them take malicious actions, such as exfiltrating database contents and sensitive business and personal information.
In the past five months, Google and four other organizations—with little in common except for their use of AI agents—have acknowledged vulnerabilities that exploit one agent inside a targeted network to spread harmful instructions to other internal agents. The technique is a special form of prompt injection that targets not the LLM but a particular agent, such as one for translation or data analysis. Guardrails inside such agents, if they exist at all, are often lax and will send the instructions to other agents down the chain. Because the latter agent explicitly trusts the first one, it follows the directions.
Unexpected and hard to mitigate
Independent researcher Syed Anas Mohiuddin tested agents from organizations including Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. His proof-of-concept attacks exploit trust gaps in MCP, short for Model Context Protocol . The standard is one way AI apps and agents communicate with each other inside an internal network. The illustration below shows a simplified MCP in action.