Securing AI Agent Execution
2025/10/24 by Bühler, Christoph, Biagiola, Matteo, Di Grazia, Luca +1 · 2 citations
#Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #D.2.0 #FOS: Computer and information sciences #Software Engineering (cs.SE)
paper · doi:10.48550/arxiv.2510.21236
Abstract
Large Language Models (LLMs) have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol (MCP) has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers execute with unrestricted access to host systems, creating a broad attack surface. In this paper, we introduce AgentBound, the first access control framework for MCP servers. AgentBound combines a declarative policy mechanism, inspired by the Android permission model, with a policy enforcement engine that contains malicious behavior without requiring MCP server modifications. We build a dataset containing the 296 most popular MCP servers, and show that access control policies can be generated automatically from source code with 80.9% accuracy. We also show that AgentBound blocks the majority of security threats in several malicious MCP servers, and that policy enforcement engine introduces negligible overhead. Our contributions provide developers and project managers with a practical foundation for securing MCP servers while maintaining productivity, enabling researchers and tool builders to explore new directions for declarative access control and MCP security.
Citations
- A Measurement Study of Model Context Protocol Ecosystem
- We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems
- A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures
- Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers
- We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems
- Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
- SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems
- MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol
- AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challenges
- Security of Internet of Agents: Attacks and Countermeasures
- MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System
- Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies
- MCP Bridge: A Lightweight, LLM-Agnostic RESTful Proxy for Model Context Protocol Servers
- MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits
- Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
- Large Language Model Agent: A Survey on Methodology, Applications and Challenges
- ToolFuzz -- Automated Agent Tool Testing
- Magentic-One: A Generalist Multi-Agent System for Solving Complex Tasks
- Imprompter: Tricking LLM Agents into Improper Tool Use
- AutoCodeRover: Autonomous Program Improvement
- Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack
- A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems
- Large Language Model based Multi-Agents: A Survey of Progress and Challenges
- Exploring Large Language Model based Intelligent Agents: Definitions, Methods, and Prospects
- OpenAgents: An Open Platform for Language Agents in the Wild
- An Empirical Study of the Non-Determinism of ChatGPT in Code Generation
- Auto-GPT for Online Decision Making: Benchmarks and Additional Opinions
- Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study
- Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
- Evaluating Large Language Models Trained on Code
- Language Models are Few-Shot Learners
- Security of OS-level virtualization technologies: Technical report
Cited by
Related