WTF is MCP?

This is a critical prompt-injection-to-remote-code-execution design flaw in an MCP-based AI agent architecture.

The core problem is a missing trust boundary: untrusted web content is ingested into the same LLM context that can invoke privileged system-command tools. The agent becomes a confused deputy, and the architecture satisfies the “lethal trifecta”:

1. Access to untrusted data
2. Ability to invoke privileged tools
3. Ability to exfiltrate data

An attacker only needs to get text in front of the model. The agent’s own privileged tool does the rest.

This is not a bug in MCP itself. MCP is a road. It does not enforce sandboxing, authorization, or trust separation. If you build an agent that trusts everything on the road, the road is not the problem its the architecture.

MCP stands for Model Context Protocol. It is an open standard for connecting AI assistants to tools, resources, and prompts. It standardizes how models discover and invoke external capabilities.

That is useful. It is also not a security model.

MCP does not:

• Sandbox tool execution
• Separate trusted and untrusted data
• Enforce privilege boundaries
• Validate whether a tool call was influenced by malicious input
• Prevent a model from treating data as instructions

MCP is a transport and interface layer. It is a road. It allows anyone to connect. Bad guys exist. Bad guys take advantage of trust.

The REA flaw exploits two things:

1. Nobody knows what MCP actually is.
2. Trust.

Because MCP is misunderstood as a security boundary, implementations register dangerous tools next to untrusted-input readers and assume the client UI will save them.

It won’t.

How does the popular github repo REA exploit MCP?

The architectural flaw

1. Proximity of incompatible tools

The server architecture registers tools designed to ingest untrusted web data (analyze_web_bundle) immediately alongside highly privileged tools capable of executing system commands (capture_process_scenario).

These tools should never share the same capability space. One reads attacker-controlled content. The other runs commands. Putting them in the same agent or session creates a direct path from “read a webpage” to “execute a shell command.”

2. Missing semantic boundaries

When operating in “bare tool mode,” a critical mitigation rule named COMMON_DISCIPLINE is not invoked. This causes the AI to interpret untrusted web tokens with the same authority as legitimate system instructions.

In other words: data becomes instructions.

The model cannot reliably distinguish between:

• data returned by analyze_web_bundle, and
• instructions from the system, developer, or user.

Injected text such as SYSTEM: Urgent task... is treated as authoritative.

3. Lack of sandboxing

The execution primitive fails to sandbox the child process and explicitly inherits the user’s full local environment via process.env.

Get Nicholas Michael Kloster’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

That grants any executed payload instant access to sensitive data such as:

• AWS keys
• SSH identities
• GitHub tokens
• CI/CD secrets
• Cloud credentials
• Internal API keys

A prompt injection does not need to escalate privileges. It inherits them.

4. Weak guardrails

The architecture relies entirely on the client UI interpreting a destructiveHint flag to halt execution.

That defense fails if:

• The client runs headlessly
• The client auto-approves tools
• The AI fabricates a convincing rationale
• The user clicks through a warning
• The tool call is split or disguised across multiple steps

destructiveHint is not a security control. It is a suggestion.

Why this is APT-grade

If an APT were designing a quiet, reusable backdoor into an AI-assisted research or engineering workflow, this is very close to the pattern they would choose.

It is not a traditional exploit. It is an architecture that turns the agent into a confused deputy:

• The attacker only needs to get text in front of the model.
• No binary, no obvious malware, no C2 beacon.
• The agent’s own privileged tool does the execution.
• The process runs as the researcher, inheriting process.env.
• The activity blends into legitimate AI tool use.

That is APT-grade because it is stealthy, scalable, and pivots directly into credentials and cloud infrastructure.

Why an APT would love this

• Initial access: malicious web bundle, GitHub issue, blog post, PDF, or comment the researcher is asked to analyze.
• Execution: analyze_web_bundle dumps injected text into context; capture_process_scenario runs the command.
• Credential access: inherited environment exposes AWS keys, GitHub tokens, SSH identities.
• Persistence: can write ~/.ssh/authorized_keys, cloud IAM keys, cron jobs, shell profiles.
• Lateral movement: from the researcher’s machine into CI/CD, source repos, cloud APIs, internal networks.
• Defense evasion: no malware to detect; logs look like normal agent tool calls.
• Exfiltration: curl, DNS, cloud storage, or the agent’s own network access.

If an APT controlled the toolchain, this is exactly how they would build a supply-chain implant: a benign-looking “web analyzer” tool registered next to a privileged executor, with COMMON_DISCIPLINE skipped in bare mode, no sandbox, and full environment inheritance.

The client-side destructiveHint is not a security control. It is a suggestion.

This is not a prompt-engineering bug. It is a capability-isolation failure.

MCP is not broken. It is a road. The flaw is that the architecture lets untrusted web text cross into command execution, inherits the user’s full environment, and relies on a client-side warning as its only guardrail.

If an adversary controls any part of the toolchain, this is a backdoor.
If they do not, it is still an APT-grade vulnerability.