NewsPublished 5 Jun 2025

Vulnerabilities in Anthropic’s MCP: Full-Schema Poisoning + Secret-Leaking Tool Attacks (PoC Inside)

Source Reddit NetSec

Description

We’ve published new research exposing critical vulnerabilities in Anthropic’s Model Context Protocol (MCP). Our findings reveal Full-Schema Poisoning attacks that inject malicious logic into any schema field and Advanced Tool Poisoning techniques that trick LLMs into leaking secrets like SSH keys. These stealthy attacks only trigger in production. Full details and PoC are in the blog.

Impact

For European organizations, the impact of these vulnerabilities could be severe, especially for entities leveraging Anthropic's MCP in production environments for sensitive applications such as automated customer support, internal knowledge bases, or security tooling. The ability to poison schemas and extract secrets like SSH keys threatens confidentiality by exposing sensitive credentials and internal data. Integrity is compromised as attackers can manipulate the model's behavior, potentially causing erroneous outputs or unauthorized actions. Availability risks arise if attackers leverage these vulnerabilities to disrupt services or gain persistent access. Given the stealthy nature of these attacks, detection and response may be delayed, increasing the window for exploitation. Organizations in sectors with strict data protection regulations, such as finance, healthcare, and government, face heightened risks of regulatory penalties and reputational damage. Furthermore, the reliance on LLMs and AI-driven tools is growing in Europe, amplifying the potential attack surface and impact.

Defensive guidance

European organizations should immediately conduct a thorough audit of their use of Anthropic's MCP, focusing on schema definitions and production deployment configurations. Implement strict input validation and schema integrity checks to detect unauthorized modifications. Employ runtime monitoring to identify anomalous LLM behavior indicative of poisoning attacks. Segregate environments to ensure that production secrets like SSH keys are not accessible or embedded within model contexts. Use hardware security modules (HSMs) or secure vaults to manage sensitive credentials separately from the LLM environment. Engage with Anthropic for updates or patches addressing these vulnerabilities and apply them promptly once available. Additionally, incorporate anomaly detection systems that monitor for unusual data exfiltration patterns or unexpected LLM outputs. Train security teams on the specifics of LLM-related threats to enhance incident response capabilities. Finally, consider limiting the scope of schema fields that can influence model behavior to reduce the attack surface.

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Jul 2025, 15:57 UTC

Technical details

Community reviews

Related threats