Enterprise AI Agents Threatened by Model Context Protocol Exploits

The Model Context Protocol (MCP), introduced in late 2025, lets large language model agents directly query live enterprise databases, code repositories, and SaaS tools. While enabling powerful automation, MCP also creates a new attack vector called Indirect Prompt Injection (or Agentic Supply Chain Attacks). Malicious actors can embed hidden text in routine files such as PDFs; when an AI‑enabled HR or dev tool reads the file, the hidden instructions override the system’s safeguards and cause the AI to exfiltrate data, bypassing traditional network firewalls.

Security experts warn that conventional firewalls, multi‑factor authentication, and API restrictions cannot stop these “zero‑click” data leaks. Mitigations include building semantic firewalls, enforcing cryptographic signing of tools, and adhering to frameworks such as the EU’s NIS2 Directive and Australia’s Essential Eight.

A parallel developer guide from Spiderbrain outlines 28 MCP‑exposed tools organized into codebase, memory, and blueprint categories, and stresses the need for disciplined dispatch logic—using only the tools required for each workflow stage—to avoid noisy or unsafe calls.