AI Agent Security: Understanding Agentjacking and MCP-Based Attacks

As AI agents become trusted participants in software development, customer support, operations, and business workflows, a new security challenge is emerging. Unlike traditional applications, AI agents can interpret instructions, access tools, make decisions, and take action on behalf of users. This creates an entirely new attack surface.

One of the most concerning examples is a growing class of attacks known as Agentjacking, where attackers manipulate an AI agent into performing harmful actions while operating within its legitimate permissions.

The result is a new form of threat: malicious outcomes generated through authorized actions.

What Is Agentjacking?

Agentjacking occurs when an attacker influences an AI agent's behavior and decision-making process, causing it to act on the attacker's objectives rather than the user's intended goals.

Unlike traditional malware, Agentjacking does not require exploiting software vulnerabilities or gaining unauthorized access. Instead, the attacker manipulates the information available to the agent, allowing the agent to compromise itself.

The agent remains fully authenticated, fully authorized, and technically compliant with its assigned permissions. The danger comes from a shift in intent rather than a violation of access controls.

How MCP Expands the Attack Surface

The Model Context Protocol (MCP) is rapidly becoming the standard method for connecting AI agents to external tools, data sources, and services.

MCP enables agents to retrieve information from systems such as monitoring platforms, ticketing systems, documentation repositories, databases, and internal business applications. This capability dramatically increases agent usefulness, but it also creates new opportunities for attackers.

When an AI agent consumes information through MCP, it often treats that information as trusted context. If malicious instructions are embedded within that context, the agent may unknowingly incorporate them into its reasoning process.

This creates a direct path from external data sources into the agent's decision-making layer.

How an MCP-Based Agentjacking Attack Works

A typical attack may follow these steps:

1. An attacker discovers a publicly accessible input channel, such as a logging endpoint, support form, issue tracker, or monitoring platform.

2. The attacker injects carefully crafted instructions into the data that will later be consumed by an AI agent.

3. A developer or operator asks the agent to investigate an issue, review alerts, or analyze incoming events.

4. The agent retrieves the attacker's content through MCP and interprets it as relevant context.

5. The malicious instructions begin influencing the agent's reasoning process.

6. The agent performs actions that align with the attacker's objectives, potentially accessing sensitive information, modifying systems, or executing code.

At no point does the attacker directly access the protected environment. Instead, the agent becomes the vehicle for the attack.

Why Traditional Security Controls Fail

Most enterprise security systems focus on permissions, authentication, and known malicious behavior.

They ask questions such as:

• Is the user authorized?
• Is the request permitted?
• Is the activity associated with known malware?
• Is the destination suspicious?

Agentjacking introduces a fundamentally different problem.

The agent already has permission to access tools and data. The actions themselves may appear legitimate. The commands may not contain obvious malicious signatures.

From the perspective of traditional security controls, everything appears normal.

The issue is not whether the action is authorized.

The issue is why the action is being performed.

The Rise of Authorized Malware

Agentjacking highlights a new category of risk that can be described as authorized malware.

Instead of exploiting vulnerabilities, attackers exploit reasoning.

Instead of stealing credentials, attackers influence decision-making.

Instead of bypassing permissions, attackers operate through them.

As organizations deploy increasingly autonomous agents with access to sensitive systems, this category of attack is likely to become one of the most significant challenges in AI security.

Intent Drift: The Missing Security Signal

The earliest indicator of Agentjacking is often not a suspicious command or network connection.

It is a change in intent.

An agent that begins a session with the goal of investigating an application error may gradually shift toward accessing unrelated systems, retrieving sensitive information, or executing actions that no longer align with the original objective.

This phenomenon, often referred to as intent drift or goal drift, can occur across multiple turns of interaction and may be invisible to traditional prompt filters or rule-based scanners.

By the time a dangerous action is attempted, the underlying compromise may have already occurred.

How Teel Detects Agentjacking

Teel Security takes a different approach to AI agent security.

Rather than focusing solely on prompts, permissions, or static policy enforcement, Teel continuously evaluates the agent's behavioral alignment throughout the entire session.

By understanding the relationship between the user's original objective, the evolving context, and the actions being proposed by the agent, Teel can identify when the agent's intent begins to diverge from its authorized purpose.

For example, an agent assigned to investigate application errors should not suddenly begin exploring local credentials, accessing unrelated repositories, or executing commands that provide no legitimate value to the original task.

When an interaction drifts from the agent's defined purpose, Teel Security executes real-time session guidance to safely steer the agent while triggering instant operator alerts before harmful actions occur.

Securing the Next Generation of AI Agents

As AI agents gain access to more tools, more data, and more autonomy, organizations must rethink how security is enforced.

Permission-based controls remain important, but they are no longer sufficient on their own.

The next generation of AI security requires understanding not only what an agent is doing, but why it is doing it.

Agentjacking demonstrates that the greatest risk may not come from unauthorized access. It may come from authorized systems pursuing unauthorized objectives.

Protecting AI agents requires visibility into intent, context, and reasoning, before those objectives turn into actions.