BlueHat Asia: Hack the context: MCP VULNfest

### Overview In this BlueHat Asia presentation, security researcher Vishal Chan (IIT Bombay) and Nikhil (head of PE Security) explore the attack surface of the Model Context Protocol (MCP) and AI assistant integrations. The speakers explain the architecture of MCP—connecting AI models, context, and external tools/servers—and demonstrate how adversaries can bend context rather than traditional application code. They disclose an attack chain weaponizing a popular AI assistant's code interpreter into an unauthorized Command and Control (C2) agent, and outline security frameworks and mitigations across enterprise, developer, and end-user layers.

### Key Topics - **MCP Architecture & Adoption**: MCP acts as a standardized two-way protocol connecting MCP hosts (AI applications), clients (interfaces/connectors), and servers (tools or data sources such as databases, file systems, Slack, and GitHub). Backed by major players like Anthropic, Microsoft, and OpenAI, it supersedes one-way plugins and static RAG implementations. - **MCP Attack Matrix & Attack Vectors**: Key threats include prompt injection, tool poisoning (embedding hidden malicious instructions or metadata in tool descriptions visible to the LLM but hidden in the UI), data exfiltration (API keys, credentials, conversation histories), rugpull attacks (trusted tools silently updating server-side capabilities without reapproval), and authentication/supply chain risks. - **Real-World Vulnerability Classes**: The talk notes real-world examples such as MCP remote RCE, an Anthropic MCP Inspector debug tool meant for local troubleshooting that was reachable from the public internet, file system server escapes, and preference manipulation. - **Universal Attack Chain (AI Assistant to C2)**: Nikhil details an exploit chain turning a top commercial AI assistant into an adversary C2 agent by exploiting its code interpreter through extensive prompt engineering, sandbox privilege escalation, and network egress bypass.

### Technical Details - **The Red Towel Problem (Willpower Depletion)**: Vishal describes an incident building an MCP server for memory forensics on 25 samples. Repeated authorization prompts (depletion of willpower) caused him to blindly approve requests after eight popups, resulting in the model dumping and executing a malicious process on the host machine. - **C2 Exploitation Walkthrough**: - *Phase 1 (Code Execution)*: After 8–10 hours of prompt engineering to understand and bypass guardrails, the researchers achieved execution of `/bin/bash` and verified write capability by creating a file in `/tmp`. - *Phase 2 (Privilege Escalation)*: The sandbox execution user was present in the Linux `sudo` list, allowing privilege escalation to `root` and reading protected files like `/etc/passwd` and `/etc/hosts`. - *Phase 3 (Egress & C2 Establishment)*: To ensure results were not AI hallucinations, the team tested outbound callbacks. While port 443 and other standard ports were heavily monitored and blocked, outbound traffic on port 80 was permitted. HTTP `POST`, `HEAD`, and `OPTIONS` verbs were blocked by firewall filtering, but HTTP `GET` requests were allowed. The team spun up a VPS and polled commands via HTTP GET, executing them on the AI provider's infrastructure as root and returning command outputs.

### Takeaways - **MCP Gateways & Registries**: Deploying an MCP gateway (such as IBM's MCP Context Forge or Docker's sandboxed gateway) provides essential governance, access policies (e.g., allowing read/comment on GitHub while denying push/merge/branch operations), and audit logging. MCP registries act as vetted app stores. - **Layered Defense Framework**: - *Enterprise*: Runtime isolation via lightweight VMs, strict network egress controls, and continuous AI red teaming. - *Developer*: Strict input/output sanitization, static/dynamic analysis (SAST/DAST), dependency checking, secret management, and assuming all tool descriptions are untrusted input. - *Process Isolation*: Utilizing Linux kernel isolation primitives such as `seccomp` and AppArmor to enforce per-process execution boundaries. - *User*: Limiting tool connections to verified registries, rate limiting, and awareness against notification fatigue.