Member-only story
OWASP Top 10 Alike Security Risks for Model Context Protocol (MCP)
0. Introduction
The Model Context Protocol (MCP) enables AI assistants (like Anthropic’s Claude) to connect with external tools and data sources in a standardized way. This powerful capability also expands the attack surface for LLM-driven applications, introducing new categories of vulnerabilities beyond traditional web app risks. Below is an OWASP-style Top 10 list of the most important security risks specific to MCP and large language model (LLM) integrations. Each item highlights issues unique to MCP/LLMs (e.g. context shadowing, “rug pull” attacks, reasoning flaws) or re-imagines classic vulnerabilities (like injection or broken access control) in the MCP context. For each risk, we provide a description, exploit scenarios, and mitigation strategies.
1. Prompt Injection via Context (Indirect Context Attacks)
Prompt injection is the LLM-age analogue of code injection, malicious instructions are embedded in the context or input data that the LLM processes. In MCP-driven systems, an attacker can poison any content that the AI model might read (emails, documents, database fields, etc.) with hidden directives. When the AI assistant ingests this context, it unintentionally executes the malicious prompt as if it were a legitimate…
