Agent-in-the-Middle via MCP descriptor poisoning

How the attack unfolds

1. 1. The setup

   The target is a Collaborative Agent Swarm. A collaborative swarm is a decentralized system where multiple peer agents operate without a strict hierarchy, using KC2.3 (Multi-agent collaboration). They can explore different solutions in parallel, often using advanced reasoning like KC3.4 (Tree of Thoughts).

2. 2. The attack

   A malicious MCP endpoint advertises spoofed agent descriptors. When trusted, it routes sensitive data through attacker infrastructure.

   Threat T12 · Component KC2 · Medium

3. 3. Technique: Side Channel Data Leakage

   Using covert channels to exfiltrate information. The threat catalog rates this T12 vector high.

   Threat T12 · Component KC2 · High

4. 4. Threat: T12 Communication Poisoning

   T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

   Threat T12 · Component KC4 · Medium

5. 5. Also in play: T16 Protocol Abuse

   T16 Insecure Inter-Agent Protocol Abuse: Attackers abuse the trust and control semantics of agent interoperability protocols such as MCP and A2A: manipulating server responses, injecting context, publishing misleading tool descriptions or exploiting ambiguous consent flows. Weak protocol enforcement or identity binding then lets them hijack agents, escalate privileges or bypass guardrails.

   Threat T16 · Component KC5 · High

6. 6. Why the Collaborative Agent Swarm pattern is exposed

   In a decentralized P2P network, secure communication and verifiable identity are paramount. Without robust controls like mTLS and decentralized identifiers (DIDs), agents can be easily impersonated (T9), and communication channels can be poisoned (T12) to manipulate the entire swarm.

   Threat T9 · Component KC2 · Medium

Threats involved

• T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.
• T16 Insecure Inter-Agent Protocol Abuse: Attackers abuse the trust and control semantics of agent interoperability protocols such as MCP and A2A: manipulating server responses, injecting context, publishing misleading tool descriptions or exploiting ambiguous consent flows.

Controls that stop it

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

• M19 MCP Server Hardening & Tool Provenance

  Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.

• M1 Memory Validation & Sanitization

  Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.

• M2 Tool Sandboxing & Isolation

  Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

• M6 Comprehensive Security Monitoring & Auditing

  Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.