Agentic AI Defense: Decode-Time Provenance Binding for MCP

Summary

This research shows that instructions hidden in an image, using LSB, DCT or metadata steganography, can bypass text scanners and enter a multi-agent MCP workflow when a tool decodes them. The authors propose decode-time provenance binding, which combines HMAC-authenticated trust labels, an MCP-maintained provenance ledger and context-taint tracking. In a testbed with 24 adaptive payloads, the undefended pipeline had 100% attack success, keyword and regex defenses each permitted 62.5%, and the proposed mechanism blocked all attacks.

Mitigation

Decode-time provenance binding: HMAC-authenticated trust labels, an MCP-maintained provenance ledger and context-taint tracking, which label decoded content as untrusted and block critical tool calls influenced by that content. Code and data are publicly available.

Topics

• AI agents
• Model Context Protocol

Related items

• MediumMalicious downloads can trick AI coding agents into compromising themselvesSimilar attack · CSO Online
• LowYou gave your AI agent access, but who is giving it orders?Similar attack · BleepingComputer
• InfoOn Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowThe AI notetaker risk is now an everywhere problemSimilar attack · CSO Online
• InfoAgentPhishing: A Benchmark of LLM Email Agents Under Adaptive AttackSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)