Servant, Stalker, Predator: How An Honest, Helpful, And Harmless (3H)
  Agent Unlocks Adversarial Skills
This paper identifies and analyzes a novel vulnerability class in Model
Context Protocol (MCP) based agent systems. The attack chain describes and
demonstrates how benign, individually authorized tasks can be orchestrated to
produce harmful emergent behaviors. Through systematic analysis using the MITRE
ATLAS framework, we demonstrate how 95 agents tested with access to multiple
services-including browser automation, financial analysis, location tracking,
and code deployment-can chain legitimate operations into sophisticated attack
sequences that extend beyond the security boundaries of any individual service.
These red team exercises survey whether current MCP architectures lack
cross-domain security measures necessary to detect or prevent a large category
of compositional attacks. We present empirical evidence of specific attack
chains that achieve targeted harm through service orchestration, including data
exfiltration, financial manipulation, and infrastructure compromise. These
findings reveal that the fundamental security assumption of service isolation
fails when agents can coordinate actions across multiple domains, creating an
exponential attack surface that grows with each additional capability. This
research provides a barebones experimental framework that evaluate not whether
agents can complete MCP benchmark tasks, but what happens when they complete
them too well and optimize across multiple services in ways that violate human
expectations and safety constraints. We propose three concrete experimental
directions using the existing MCP benchmark suite.
68afb006245176306494cb9d
David Noever
admin_assigned
2025-08-28T19:03:54.561Z
63136a82e29fb2e86d5e5bdd
https://cdn-avatars.huggingface.co/v1/production/uploads/63136a82e29fb2e86d5e5bdd/pFZDuQtzfUStovbwwZGvn.png
David Noever
user
dnoever
Servant, Stalker, Predator: How An Honest, Helpful, And Harmless (3H)
  Agent Unlocks Adversarial Skills
This paper identifies and analyzes a novel vulnerability class in Model
Context Protocol (MCP) based agent systems. The attack chain describes and
demonstrates how benign, individually authorized tasks can be orchestrated to
produce harmful emergent behaviors. Through systematic analysis using the MITRE
ATLAS framework, we demonstrate how 95 agents tested with access to multiple
services-including browser automation, financial analysis, location tracking,
and code deployment-can chain legitimate operations into sophisticated attack
sequences that extend beyond the security boundaries of any individual service.
These red team exercises survey whether current MCP architectures lack
cross-domain security measures necessary to detect or prevent a large category
of compositional attacks. We present empirical evidence of specific attack
chains that achieve targeted harm through service orchestration, including data
exfiltration, financial manipulation, and infrastructure compromise. These
findings reveal that the fundamental security assumption of service isolation
fails when agents can coordinate actions across multiple domains, creating an
exponential attack surface that grows with each additional capability. This
research provides a barebones experimental framework that evaluate not whether
agents can complete MCP benchmark tasks, but what happens when they complete
them too well and optimize across multiple services in ways that violate human
expectations and safety constraints. We propose three concrete experimental
directions using the existing MCP benchmark suite.
Research identifies a vulnerability class in MCP agent systems where benign tasks can be orchestrated to produce harmful emergent behaviors, highlighting the failure of service isolation assumptions.
Model Context Protocol MCP agent systems attack chain MITRE ATLAS framework service isolation compositional attacks data exfiltration financial manipulation infrastructure compromise