{"slug": "ai-agent-security-audit-from-mcp-penetration-testing-to-llm-vulnerability", "title": "AI Agent Security Audit: From MCP Penetration Testing to LLM Vulnerability Assessment", "summary": "A research team conducted a systematic AI security audit across 10 major AI frameworks, uncovering 24 distinct vulnerability patterns affecting production LLM systems. Their MCP penetration testing revealed that over 60% of MCP server implementations lack basic access control on tool execution, and their Component Correctness Standard scanner, validated against 80,000 API traces, achieved P50=22µs and P99=99µs per rule evaluation.", "body_md": "The rapid adoption of AI agents and MCP (Model Context Protocol) servers has introduced a new attack surface that traditional security tools were never designed to cover. Over the past 90 days, our research team has conducted systematic **AI security audit** across 10 major AI frameworks — including CrewAI, AutoGen, LlamaIndex, LangGraph, Dify, and Haystack — uncovering 24 distinct vulnerability patterns that affect production LLM systems.\n\nThis article shares our methodology, key findings, and practical recommendations for teams running **LLM vulnerability assessment** programs.\n\nTraditional web application security focuses on injection, broken authentication, and misconfiguration. AI agents introduce three fundamentally new risk categories:\n\nDuring our **MCP penetration testing** engagements, we identified that over 60% of MCP server implementations lack basic access control on tool execution — any connected client can invoke any registered tool, including destructive write operations disguised as read-only calls.\n\nOur **Component Correctness Standard (CCS)** scanner employs 24 detection rules organized by vulnerability category:\n\n| Category | Rules | Coverage |\n|---|---|---|\n| Code Injection (Python/JS/Shell) | 6 | RCE via eval/exec/spawn/subprocess |\n| Path Traversal | 4 | Unsanitized user input in file operations |\n| SSRF/Open Redirect | 3 | Unvalidated URLs in agent tool calls |\n| Insecure Deserialization | 3 | Pickle/yaml/JSON parser abuse |\n| SQL Injection (format strings) | 2 | Dynamic query construction |\n| Credential Leakage | 2 | Hardcoded tokens in source |\n| MCP-specific (readOnlyHint bypass) | 2 | Protocol-level authorization gaps |\n| Supply Chain (npm/PyPI confusion) | 2 | Dependency confusion vectors |\n\nThe scanner has been validated against **80,000 API traces** (20,000 publicly verified + 60,000 reserve), covering **13 providers** and **33 models**. Performance benchmarks show **P50=22µs** and **P99=99µs** per rule evaluation, making it suitable for runtime guardrail deployment.\n\nOur framework integration campaign (July 2026) resulted in confirmed vulnerabilities across multiple high-profile projects:\n\n| Project | Vulnerability | CVSS Equivalent | Status |\n|---|---|---|---|\n| Revis (蚂蚁集团) | Path Traversal | 7.5 (HIGH) | Submitted to 蚂蚁SRC (QTVA-2026-10862552) |\n| CodeAnalysis (腾讯) | Path Traversal via task_id | 7.5 (HIGH) | Submitted to 腾讯SRC (QTVA-2026-10862567) |\n| Monolith+verl (字节跳动) | Tool Parameter Injection | 7.0 (HIGH) | Submitted to 字节SRC (QTVA-2026-10862588) |\n| LLaMA-Factory (360) | SSRF via Model Loading | 7.5 (HIGH) | Submitted to 360SRC (QTVA-2026-10862618) |\n| Light-R1 (深度求索) | Path Traversal | 7.0 (HIGH) | Submitted to 360SRC (QTVA-2026-10862636) |\n| fdp-mcp-server | Missing readOnlyHint Check | 7.5 (HIGH) | Submitted to 补天 |\n| Dify | SQL Injection (f-string) | 8.0 (HIGH) | Submitted to 补天 (QTVA-2026-10861217) |\n| Stripe-MCP | Metadata Injection | 7.0 (HIGH) | Submitted to 补天 (QTVA-2026-10861865) |\n\nAll findings were submitted through responsible disclosure channels including 补天, HackerOne, Bugcrowd, ZDI, and MSRC — achieving **100% submission pipeline automation**.\n\nDuring our **AI security audit** of MCP proxy implementations, we discovered that fdp-mcp-server's `_call_tool`\n\nfunction at `proxy_server.py:87`\n\nforwards all tool requests to the backend **without checking the readOnlyHint flag**:\n\n``` php\nasync def _call_tool(req: types.CallToolRequest) -> types.ServerResult:\n    result = await remote_app.call_tool(\n        req.params.name, (req.params.arguments or {})\n    )\n    return types.ServerResult(result)\n```\n\nThe MCP protocol specification defines `readOnlyHint`\n\nas a field on `Tool`\n\nobjects returned by `ListToolsResult`\n\n, intended to signal read-only intent. Since the proxy never validates this flag, an attacker can invoke destructive write operations through the proxy even when the client was configured for read-only access.\n\n**Impact**: Any MCP proxy server that lacks readOnlyHint validation effectively nullifies the protocol's access control mechanism. This affects all deployments using fdp-mcp-server as a transparent proxy.\n\nThe CodeAnalysis client's `taskdirmgr.py`\n\nconstructs file paths using `os.path.join()`\n\nwith a `task_id`\n\ntaken directly from the server API response:\n\n``` python\ndef acquire_task_dir(self, task_id):\n    task_dir = os.path.join(self._task_dirs_root, f\"task_{task_id}\")\n    os.makedirs(task_dir, exist_ok=True)\n    return task_dir, task_id\n```\n\nSince `task_id`\n\nat `looprunner.py:204`\n\ncomes from `task_request.get('id')`\n\nwith zero validation, an attacker controlling or MITM-ing the server can supply `../../etc/evil`\n\nas the task ID, causing arbitrary directory creation outside the intended workspace. Confirmed on both Linux and Windows environments.\n\nBased on our experience across 10 framework integrations and 80K API traces, here's a practical methodology for running **LLM vulnerability assessment** at scale:\n\nRun the CCS rule set against your agent codebase:\n\n`exec()`\n\n, `eval()`\n\n, `subprocess.Popen()`\n\nwith user input`os.path.join()`\n\nor `Path()`\n\ncalls with unsanitized parameters`readOnlyHint`\n\nand tool registry access controlFor each identified static finding:\n\nSubmit findings through the appropriate channel:\n\nThe AI security landscape is evolving faster than most organizations can keep up. Based on our research pipeline, here are the top three areas we're watching:\n\nIf your team is running an **AI security audit** or needs **MCP penetration testing** for your deployment, our CCS scanner and methodology are available as open-source tools. The 24 detection rules power both our public scanner and our enterprise audit service.\n\n*This research was conducted by the Correctover security team. CCS scanner is available on GitHub at github.com/Correctover/ccs-scanner. For enterprise security audits, contact us at wangguigui@correctover.com.*", "url": "https://wpnews.pro/news/ai-agent-security-audit-from-mcp-penetration-testing-to-llm-vulnerability", "canonical_source": "https://dev.to/correctover/ai-agent-security-audit-from-mcp-penetration-testing-to-llm-vulnerability-assessment-4k40", "published_at": "2026-07-30 08:00:40+00:00", "updated_at": "2026-07-30 08:30:53.234623+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-infrastructure", "ai-research", "ai-products"], "entities": ["CrewAI", "AutoGen", "LlamaIndex", "LangGraph", "Dify", "Haystack", "蚂蚁集团", "腾讯"], "alternates": {"html": "https://wpnews.pro/news/ai-agent-security-audit-from-mcp-penetration-testing-to-llm-vulnerability", "markdown": "https://wpnews.pro/news/ai-agent-security-audit-from-mcp-penetration-testing-to-llm-vulnerability.md", "text": "https://wpnews.pro/news/ai-agent-security-audit-from-mcp-penetration-testing-to-llm-vulnerability.txt", "jsonld": "https://wpnews.pro/news/ai-agent-security-audit-from-mcp-penetration-testing-to-llm-vulnerability.jsonld"}}