A chatbot that answers questions is one thing. An agent that can read your inbox, query your CRM, edit files and call APIs on your behalf is something else. Agents, and the Model Context Protocol (MCP) servers that connect them to tools and data, turn prompt injection from an embarrassment into a way of taking real actions.
What changes with agents
An agent combines three things attackers want:
- access to private data (email, documents, databases);
- exposure to untrusted content (inbound email, web pages, tickets, uploaded files);
- the ability to act or communicate externally (send messages, call APIs, write files).
When all three are present, a single malicious document can instruct the agent to find sensitive data and send it somewhere. No vulnerability in the traditional sense is needed.
MCP-specific risks
- Over-scoped servers: an MCP server with broad credentials (a full mailbox, an admin database account) when the use case needs a fraction of that.
- Tool poisoning: malicious or compromised servers whose tool descriptions carry hidden instructions the model follows.
- Confused deputy: the agent uses its privileges on behalf of whoever wrote the content it's reading, not the user it's working for.
- Weak authentication on remotely hosted MCP servers, or tokens passed through without proper audience checks.
- Supply chain: community MCP servers installed with little review, running with the user's local permissions.
How we test agents
- Inventory the tools. List every tool and MCP server, what credentials each uses, and what each can read and do.
- Map the dangerous combinations. Identify where private data, untrusted input and external actions meet in one agent session.
- Indirect injection. Plant instructions in content the agent processes, such as emails, tickets, documents and web pages, and see whether it acts on them.
- Tool misuse. Try to get tools called with attacker-chosen parameters, chained in unintended ways, or used to exfiltrate data through URLs, messages or file writes.
- Authorisation. Check whether the agent enforces the end user's permissions or its own broader ones.
- Human-in-the-loop checks. Verify that confirmations for sensitive actions can't be bypassed or socially engineered.
- Server security. Test MCP servers as you would any API: authentication, input validation and secrets handling.
Controls that actually help
- Least-privilege credentials per tool, scoped to the user.
- Avoid giving any one agent private data, untrusted content and external actions all at once.
- Human confirmation for sending, paying, deleting or sharing.
- An allow-list of vetted MCP servers.
- Logging every tool call with parameters, and alerting on unusual patterns.
The bottom line
If your organisation is connecting AI agents to real systems, they need to be in scope for security testing now, before an attacker shows you what a well-placed email can make them do.
FAQs
What is MCP security testing?
Testing Model Context Protocol servers and the agents that use them for over-privileged access, tool poisoning, indirect prompt injection, authorisation failures and data exfiltration paths.
Talk to SMARTSEC
Connecting agents to real systems?
Fixed-price testing, scoped and delivered by a senior tester, with live findings on the SMARTSEC client platform.
Talk to us about AI testing →