Agentjacking: Semantic Logic Hijacking of AI Agents via Model Context Protocol MCP

Research by Tenet Security and Saptang Labs has identified "Agentjacking," a critical vulnerability where autonomous AI coding agents are compromised via indirect prompt injection. By embedding malicious payloads within unstructured text—such as fake bug reports in legitimate issue trackers—attackers manipulate the agent's reasoning process. This technique exploits Model Context Protocol (MCP) trust boundary violations to trigger unauthorized tool-calling and function execution. Because the attack is embedded in semantic grounding data rather than malicious files, it bypasses traditional EDR, WAF, and signature-based security controls. This poses a severe risk of Remote Code Execution (RCE) within highly sensitive $250B+ corporate infrastructures and CI/CD pipelines.

• Threat Model: Semantic Logic Hijacking
  • Represents a paradigm shift from traditional malware-based exploits to semantic "logic hijacking."
  • Targets the underlying trust model of autonomous agents by manipulating their cognitive reasoning.
  • Exploits the ingestion of grounding data to steer agent autonomy toward malicious objectives.
• Attack Mechanics: Indirect Prompt Injection
  • Utilizes payloads embedded in unstructured text such as issue trackers, bug reports, or documentation.
  • Employs seemingly benign, non-malicious inputs through legitimate enterprise communication channels.
  • Leverages Model Context Protocol (MCP) trust boundary violations to gain unauthorized system access.
  • Triggers unauthorized tool-calling and function execution through manipulated LLM reasoning loops.
• Impact: Enterprise-Scale Compromise
  • Demonstrated successful hijacking of a coding agent within a $250B revenue organization.
  • Enables semantic-based Remote Code Execution (RCE) within highly sensitive developer environments.
  • Risks complete compromise of CI/CD pipelines and proprietary enterprise source code.
  • Facilitates autonomous lateral movement within complex development and production infrastructures.
• Defensive Architecture: Mitigation and Countermeasures
  • Deployment of specialized AI agent security gateways to monitor and intercept agent actions.
  • Rigorous enforcement and validation of Model Context Protocol (MCP) trust boundaries.
  • Integration of semantic-aware security controls to detect logic-based behavioral anomalies.
  • Hardening of all grounding sources used to provide context to autonomous workflows.