Security Researchers Uncover Critical Vulnerabilities in MCAP AI Agent Protocol

The presentation 'MCAP Unchained' by security researchers from Tencent and Trend Micro examines vulnerabilities in the MCAP (Model Connector Access Protocol) ecosystem, a universal connector for AI agents. The team identified a threat shift from exploiting software bugs to manipulating agent context, demonstrating attacks like remote code execution on Cursor IDE via indirect prompt injection and cross-plugin data exfiltration in ChatGPT, including Gmail data theft. Key risks include insecure defaults in MCAP SDKs (e.g., wildcard allow-origin settings in Python, TypeScript, and PHP implementations), protocol-level flaws like 'initiation fishing' (native phishing via UI forms) and account takeover via stateless OAuth handshakes, and supply chain threats from unscanned registries (e.g., mcp.so) and semantic routing hijacking. The researchers highlighted that these issues stem from design choices—such as MCAP’s dynamic client registration (DCR) and lack of protocol-level security enforcement—rather than bugs, making them harder to mitigate. They also introduced AI Infraguard, an open-source red-teaming platform for scanning AI agents and MCAP servers. The talk concluded with recommendations for marketplace scanning, sandbox isolation, and user vigilance against suspicious data requests.