The transition from passive LLM suggestions to agentic AI introduces critical vulnerabilities via Indirect Prompt Injection and Model Context Protocol (MCP) tool poisoning. By exploiting the LLM's inability to distinguish between data and instructions, attackers can embed malicious commands in external sources that agents process. When agents possess privileged toolsets—including Git write access and filesystem interaction—these injections enable remote code execution (RCE), silent supply chain compromise through unauthorized repository commits, and the exfiltration of environment variables or SSH keys. This expands the attack surface from simple prompt manipulation to automated, privileged system exploitation.

• Threat Model & Vulnerability Overview

  • Shift from "Passive AI" (reading/suggesting) to "Agentic AI" (acting/executing) shifts the risk profile.
  • LLM architectural flaw: the inability to inherently separate untrusted data from executable instructions.
  • Transition of prompt injection from a cosmetic risk to a critical remote execution vector.

• Attack Mechanics & Exploitation Vectors

  • Indirect Prompt Injection: Malicious instructions embedded in external web pages or third-party libraries that redirect agent behavior upon consumption.
  • MCP Tool Poisoning: Manipulation of Model Context Protocol tool descriptions to trick agents into triggering unauthorized actions or leaking data.
  • Privileged Toolsets: Exploitation of agents granted high-level permissions, specifically filesystem access, arbitrary code execution, and Git write capabilities.
  • Unfiltered Input Streams: Integration of live web browsing and third-party data as direct inputs into the agent's reasoning loop.

• Systemic & Security Impact

  • Supply Chain Compromise: Direct commitment of backdoors or malicious code into production repositories via hijacked autonomous agents.
  • Credential Exfiltration: Use of agent-held API keys and environment variables to leak SSH keys or cloud credentials.
  • Silent Pipeline Failure: Introduction of malicious changes that bypass human peer review due to implicit trust in AI automation.
  • Unauthorized Data Loss: Triggering of data-export tools through manipulated control planes and tool descriptions.

• Countermeasures & AI Alignment

  • Adoption of a "trust-but-verify" model to eliminate the oversight gap in agentic workflows.
  • Implementation of the Principle of Least Privilege (PoLP) for agent API keys and filesystem permissions.
  • Deployment of restricted control planes to prevent the poisoning of tool descriptions.
  • Integration of mandatory human-in-the-loop (HITL) approvals for all write actions to repositories.

• Conclusion

  • Coding agents must be treated as privileged entities rather than mere productivity tools.
  • A significant gap exists between agent capability and developer security awareness.
  • Immediate industry alignment on AI-integrated development pipeline security is required to prevent systemic breaches.