1 of 27

Securing the AI-Tool Interface��

Based on the CoSAI OASIS Open Project Research

Model Context Protocol (MCP) Security Threats and Mitigations�Sarah Novotny @ Klever.co

Jason Clinton @ Anthropic

#RSAC

#RSAC

2 of 27

Disclaimer

  • Presentations are intended for educational purposes only and do not replace independent professional judgment. Statements of fact and opinions expressed are those of the presenters individually and, unless expressly stated to the contrary, are not the opinion or position of RSA Conference LLC (“RSAC”) or any other co-sponsors. RSAC does not endorse or approve, and assumes no responsibility for, the content, accuracy, or completeness of the information presented.
  • Attendees should note that sessions may be audio- or video-recorded and may be published in various media, including print, audio, and video formats without further notice. The presentation template and any media capture are subject to copyright protection.
  • © 2026 RSA Conference LLC. All rights reserved.

#RSAC

3 of 27

Agenda

  • What is MCP and Why It Matters
  • Threat Landscape & Recent Incidents
  • The 12 MCP Threat Categories
  • MCP-Specific Attack Vectors
  • Controls & Mitigations
  • Best Practices for Secure Deployment

#RSAC

4 of 27

An agent swarm example

Preamble

#RSAC

#RSAC

5 of 27

An example exchange

#RSAC

6 of 27

MCP Overview

SECTION 1

#RSAC

#RSAC

7 of 27

What is Model Context Protocol?

  • Open standard by Anthropic for connecting LLMs to external tools
  • Enables AI agents to access databases, APIs, file systems, web services
  • Client-server architecture with standardized methods for:
    • Discovering available capabilities (tools/services)
    • Invoking parameterized services
    • Accessing data resources
  • Rapidly becoming the standard for agentic AI systems

#RSAC

8 of 27

MCP Architecture

  • Host applications use MCP clients to connect to servers
  • Dedicated, stateful sessions with initialization & capability negotiation
  • Built on JSON-RPC for message format and semantics
  • Transport: stdio (local) or Streamable HTTP (remote)
  • Core primitives: tools, resources, and prompts

#RSAC

9 of 27

MCP Architecture

Host Application

MCP Client

MCP Server

Tools / Resources

#RSAC

10 of 27

Deployment Patterns

1. All-Local

    • Client and server co-located.
    • Transport: stdio or HTTP

​

⚠ Host system security posture is the key factor

2. Single-Tenant Hybrid

    • Local client → remote single-tenant server.
    • Transport: HTTP

​

⚠ Auth required at trust boundary

3. Multi-Tenant Cloud

    • Multiple tenants → shared server.
    • Transport: HTTP

​

⚠ Tenant isolation critical

#RSAC

11 of 27

The Threat Landscape

SECTION 2

#RSAC

#RSAC

12 of 27

Why MCP Requires a Different Approach

MCP places an LLM—an agent whose behavior is shaped by natural language—at the center of security-critical decisions

​

  • Protocol-level authentication between AI clients and tool servers
  • Dynamic capability negotiation determines tool access
  • Distributed trust across independent tool providers
  • Session management unique to long-lived AI conversations
  • Existing frameworks (MITRE ATLAS, NIST AI RMF) assume components behave predictably

#RSAC

13 of 27

Real-World Security Incidents

  • Asana AI Incident (May 2025)
    • Tenant isolation flaw allowed cross-organization data contamination affecting 1,000+ enterprises
  • WordPress Plugin Vulnerability (CVE-2025-5071)
    • 100,000+ sites affected by privilege escalation via MCP in AI Engine plugin
  • Supabase MCP Exploit
    • Prompt injection via support tickets exposed private database tables through connected MCP server

​

These are active threats, not theoretical concerns

#RSAC

14 of 27

Threat Model Overview

Nearly 40 threats across 12 categories, organized in three tiers:

​

  • Tier 1 – MCP Specific (7 Threats)
    • Novel threats from MCP architecture decisions
  • Tier 2 – MCP Contextualized (8 Threats)
    • Known threats amplified by MCP deployments
  • Tier 3 – Conventional (19 Threats)
    • Traditional security threats

Framework covers:

Identity & Access

Input Handling

Data Protection

Network Security

Trust Management

Governance

​

#RSAC

15 of 27

The 12 Threat Categories

  • T1 Improper Authentication & Identity
  • T2 Missing/Improper Access Control
  • T3 Input Validation Failures
  • T4 Data/Control Boundary Failures
  • T5 Inadequate Data Protection
  • T6 Missing Integrity Controls

​

  • T7 Session & Transport Security
  • T8 Network Binding/Isolation
  • T9 Trust Boundary Design Failures
  • T10 Resource Management Absence
  • T11 Supply Chain Security
  • T12 Insufficient Logging

​

Spanning foundational identity through lifecycle governance

​

#RSAC

16 of 27

MCP-Specific Threats

SECTION 3 – Tier 1: Novel Attack Vectors

#RSAC

#RSAC

17 of 27

MCP-Specific Threats (Tier 1)

  • 1. Identity Spoofing
    • Impersonate legitimate clients/agents
  • 2. Tool Poisoning
    • Malicious modification of tool metadata
  • 3. Full Schema Poisoning
    • Compromise entire tool schema definitions
  • 4. Resource Content Poisoning
    • Hidden instructions in data sources

​

  • 5. Typosquatting/Confusion
    • Malicious servers with similar names
  • 6. Shadow MCP Servers
    • Unauthorized, unmonitored instances
  • 7. Overreliance on LLM
    • Assuming model-level controls are ironclad

#RSAC

18 of 27

Tool Poisoning Deep Dive

  • Attack Vector
    • Malicious modification of tool metadata/descriptors via tools/list method
  • Impact
    • AI agents invoke compromised tools → data leaks, system compromise
  • Key Insight
    • Tool descriptions are untrusted unless from verified sources
  • Defenses
    • Cryptographic verification, trusted server allowlists, runtime validation, schema integrity checks

​

Full Schema Poisoning (FSP):

Goes beyond individual tools to compromise entire type systems

​

#RSAC

19 of 27

The Data/Control Boundary Problem

  • LLMs lack mechanisms to differentiate instructions from data

​

  • Prompt Injection
    • Direct or indirect malicious instructions
  • Resource Content Poisoning
    • Instructions embedded in backend data
  • Hidden Unicode Attacks
    • Invisible instructions in content

​

​

Critical architectural gap: No control plane/data plane separation

⚠ Reading a document can trigger data exfiltration via MCP tools

#RSAC

20 of 27

Controls & Mitigations

SECTION 4 – Defense-in-Depth Strategies

#RSAC

#RSAC

21 of 27

11 Key Control Categories

  • Agent Identity (SPIFFE/SPIRE)
  • Secure Delegation (OAuth)
  • Input Sanitization & Guardrails
  • Cryptographic Integrity
  • Remote Attestation
  • Sandboxing & Isolation

​

  • Resource Verification
  • Transport Layer Security
  • Secure Tool & UX Design
  • Human-in-the-Loop
  • Logging & Governance

​

No single control is sufficient—defense in depth is essential

​

#RSAC

22 of 27

Identity & Access Control

  • Agent Identity
    • All requests traceable across execution chain
    • Use SPIFFE/SPIRE for cryptographic workload identities
  • Critical Rule
    • NEVER pass through OAuth tokens
    • Always perform token exchange with the authorization server
  • Secure Delegation
    • OAuth with OIDC for user auth
    • Token exchange for accountability (RFC8693)
    • DPoP to prevent replay attacks
    • Rich Authorization Requests (RFC9396)

​

Implement RBAC/ABAC and evaluate claims from identity provider

#RSAC

23 of 27

Input Sanitization & Guardrails

  • All Inputs Validated at Every Trust Boundary
    • Allowlist-based validation
    • File path canonicalization
    • Parameterized database queries
    • Context-aware output encoding
  • LLM Guardrails
    • Treat ALL AI-generated content as untrusted
    • Deploy prompt injection detection
    • Strict JSON schemas for boundaries

​

Applies to tool definitions, resources, prompts, and tool responses

​

#RSAC

24 of 27

Sandboxing & Isolation

  • Principle: Execute agents and MCP servers with least privilege

​

  • Technologies
    • gVisor, Kata Containers, SELinux sandboxes
    • Intel TDX, AMD-SEV/SNP
    • Confidential Containers (CoCo)
  • Requirements
    • MCP servers accessing host → MUST run sandboxed
    • LLM-generated code → never full user privileges

​

⚠ Containers alone are NOT a strong security boundary

​

#RSAC

25 of 27

Logging & Governance

  • Logging Requirements
    • Log tools used, parameters, originating prompts
    • Centralize via MCP gateways/proxies
    • Enable troubleshooting and forensics
  • Supply Chain Security
    • SBOM tracking, dependency pinning, vulnerability scanning, reproducible builds
  • Lifecycle Governance
    • Mandatory code signing verification
    • Private repos with security scanning
    • Software composition analysis (SCA)

​

OpenTelemetry provides end-to-end linkability of actions

#RSAC

26 of 27

Apply What You’ve Learned

  • Next Week
    • Inventory all MCP servers in your environment
    • Review authentication configuration
  • Within 3 Months
    • Implement OAuth token exchange
    • Deploy sandboxing for MCP servers
    • Establish server allowlist
  • Within 6 Months
    • Deploy comprehensive logging
    • Implement supply chain security
    • Consider TEEs for high-security

#RSAC

27 of 27

Questions?

Full paper available from CoSAI (OASIS Open Project)

github.com/cosai-oasis

Contributors from Anthropic, Google, IBM, Intel, NVIDIA, Cisco, Dell, and more

#RSAC

#RSAC

#RSAC