Overview
- Security researchers presented a clear taxonomy of agent risks that includes insecure dependencies, malicious MCP (Model Context Protocol) middlemen, prompt injection in ingested content, and agents running with broad, unscoped permissions.
- Red‑team walkthroughs showed concrete exfiltration: a customer chatbot revealed an MD5 password hash after conversational probing, and a document‑ingestion pipeline followed a permitted URL redirect to the AWS EC2 metadata endpoint and exposed credentials stored there.
- Developers commonly make five repeat mistakes that raise risk: giving agents long‑lived broad credentials, treating ingested documents as trusted, logging outputs but not decision traces, skipping adversarial testing, and lacking a kill switch for destructive actions.
- Practical, high‑return defenses available now include issuing short‑lived scoped tokens per task, sandboxing agents and their document stores, vaulting secrets instead of using env vars, curating MCP allowlists with scoped tokens, and adding decision‑level logs plus human approval gates.
- These findings build on existing guidance from OWASP and MITRE and imply that teams must shift from policy ideas to concrete runtime controls and red‑teaming before deploying agents to production to avoid leaking high‑privilege secrets.