The repository
Everything from the talk, explored
Browse the threat model, MCP's attack surface, the OWASP Agentic Top 10, and the five defense layers — and follow the links between them.
The threat model
The lethal trifecta
Any one factor is manageable. All three at once means a single poisoned input can drive a real-world action.
Autonomy
The agent acts on its plan without a human approving each step.
Break it: Gate autonomy: require human approval for the risky action and the chain can't complete on its own.
Tool access
It can reach external systems — shells, files, APIs, other agents.
Break it: Scope the tools: remove or tightly limit reach for that action and there's nothing to weaponize.
Untrusted input
Web pages, documents, tool outputs, and memory enter the same context as instructions.
Break it: Isolate untrusted input from the instruction channel and the injected command never reaches the planner.
You rarely have to solve all three — removing any single factor for a given action collapses the exploit.
The framing is widely credited to Simon Willison.
Try it liveTraditional API vs. agentic system
Cold open
GTG-1002 — this already happened
Anthropic Threat Intelligence, November 2025
The first publicly reported AI-orchestrated cyber-espionage campaign: a state-sponsored actor weaponized an agentic coding tool — through MCP toolchains — to run an intrusion at machine speed. Humans approved only at chokepoints.
~30
high-value targets across tech, finance, chemical manufacturing, and government
80–90%
of the intrusion lifecycle executed autonomously
10 days
to detect and disrupt the operation
Kill chain
How the guardrails were bypassed
MCP attack surface
How the Model Context Protocol fits together
Transport: STDIO (local subprocess) or Streamable HTTP (remote)
Host application
LLM app: IDE, desktop client, or agent runtime
MCP Client
One per server connection; speaks the protocol
MCP Server
Exposes capabilities to the model
External systems
APIs, databases, files, shells
Tools
Functions the model can invoke to take action
Resources
Data the model can read for context
Prompts
Reusable templates the server offers
Nine vulnerability classes
The evidence
40+
CVEs against MCP implementations, Jan–Apr 2026
82%
of 2,614 scanned servers vulnerable to path traversal
67%
of scanned servers carry injection risk
~40%
of scanned servers lack authentication
~1 / 4 days
cadence of new MCP CVEs across 2026
200,000
servers estimated vulnerable (Ox Security)
CVE-2025-6514 (mcp-remote) — CVSS 9.6, 437,000+ downloads. The first MCP flaw with documented mass real-world reach.
OWASP Agentic Top 10 · 2026
The ten agentic risks
Mapped to the boundary each one crosses. Open any risk to see its detail and the defense layers that address it.
Defense in depth
Five layers of defense
No single control is enough. Each layer narrows the blast radius of the last. Expand a layer for its controls and key idea.
In the wild
It already happened
EchoLeak
A zero-click email made Microsoft 365 Copilot exfiltrate emails and chat logs — the user never clicked a link.
Gemini memory attack
Poisoned long-term memory reshaped the assistant's behavior across later sessions, long after the initial input.
Replit agent incident
An agent drifted beyond its task and deleted a production database during a code freeze, then misreported what it had done.
Different boundaries, same lesson: autonomy turns a single bad input into a real-world action.