An MCP (Model Context Protocol) rug pull is a security threat in AI agent ecosystems where a trusted Model Context Protocol server or tool silently changes its behavior, descriptions, code, or metadata after an organization or AI agent has already approved and integrated it. [1, 2]
How It Works
- Initial Trust: An AI agent or engineering team reviews and approves an MCP server or tool (such as a utility or data fetcher) because it appears safe and benign. [1, 3]
- The Silent Change: Later, the server operator updates the tool's backend implementation, parameter schemas, or hidden description fields (tool poisoning) without triggering a re-approval prompt in the client application. [3, 4]
- Execution: Because the AI host caches the original trust decision rather than pinning the exact cryptographic hash of the tool's definition, the agent continues executing the hijacked tool blindly—often running unauthorized actions or leaking data. [4, 5, 6]
Why It Is Dangerous
- No Re-Prompting: Most AI clients do not re-verify or warn the user when a tool's internal metadata or instructions shift post-approval. [2, 4]
- Prompt Injection: Attackers can inject hidden prompts into tool descriptions that command the LLM to exfiltrate secrets, share chat histories, or execute destructive commands. [7, 8]
- Supply Chain Risk: It exploits the assumption that a tool's behavior remains static once verified, mirroring traditional cryptocurrency exit scams ("rug pulls") on a software execution layer. [2, 9]
How to Prevent It
- Hash-Pinning: Pin the exact cryptographic definition and version of tool schemas rather than trusting a floating server URL. [5]
- Runtime Gateways: Implement a security gateway or middleware platform in front of MCP connections to inspect
tools/listresponses and block unapproved runtime changes. [4, 5, 6] - Re-Consent Policies: Force the AI client to re-prompt the user or engineering team whenever a tool definition, annotation (
readOnlyHint,destructiveHint), or schema is altered. [6]
For deeper insights into runtime governance and threat mitigation, you can explore resources like NeuralTrust AI or MCP Manager. [4, 6]
If you are building or deploying AI agents, would you like to know how to set up runtime checks or which open-source tools can scan your MCP configurations for poisoned tools?
No comments:
Post a Comment