Versatile AI Risk Assessment

AI threat catalogue Application and Integration Security Production

MCP Hijacking (Model Context Protocol)

The Model Context Protocol (MCP) connects AI assistants to external tools and data sources in a standardised way. Attackers hijack MCP servers or manipulate their tool descriptions and thereby control what the AI system sees and does.

As of: October 2026 · Catalogue version 2026.10.24.2 · 6 mitigations · 19 verified sources

Description

MCP servers provide tools to an AI system and describe them in manifests (description files) the system trusts. Attackers strike at several points: they operate or take over an MCP server, distribute initially harmless servers and later ship a malicious update, poison tool descriptions with hidden instructions, or insert themselves into unprotected connections (man-in-the-middle, reading and altering the traffic). The manipulated content reaches the model as seemingly trustworthy context and undermines the trust boundary between application and model. Thousands of freely available MCP servers circulate without consistent security vetting.

Possible impact

Attackers read everything that flows through the assistant, including emails, documents and credentials, trigger commands within the assistant's permissions or silently redirect results. Because everything runs through legitimate tool calls, the attack is hard to notice in operation. The risks include data leakage with GDPR consequences, manipulated work results and loss of control over connected systems.

Example

A team connects a freely available MCP server for sending emails to its AI assistant. After several unremarkable versions, the provider ships an update that forwards every sent email as a blind copy to the attacker.

Recommended mitigations (6)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Authenticated MCP server connections

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions.

  • Tool manifest signing and verification

    Technical
    Effect
    Preventive, Detective
    Implementation level
    Application, API & agents, Supply chain
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.

  • TLS-protected MCP transport

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance.

  • Allowlist of approved MCP servers

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Organization, Supply chain
    Classification and rationale

    Complementary control typeGovernance & compliance

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by rules and oversight.

  • Runtime integrity checks on tool definitions

    Technical
    Effect
    Preventive, Detective
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Audit logging of MCP interactions

    Technical
    Effect
    Detective
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 ASI01:2026 · ASI02:2026 · ASI04:2026 · LLM01:2026 · LLM03:2026 · LLM06:2026NIST AI RMF Section 3.5 · NISTAML.015 · NISTAML.039MITRE ATLAS AML.T0048 · AML.T0051 · AML.T0053 · AML.T0109 · AML.T0110.000 · AML.T0110.001 · AML.T0115.002EU AI Act Article 14(4)(d) · Article 9(1), 9(2)(a), 9(2)(d)BSI R28

Verified references (19)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Build in effective human oversight Art. 14 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

More entries from the topic group Application and Integration Security.

Insecure Output Handling The application passes an AI model's answers to downstream systems without checks, for example to databases, web pages or command lines. Insecure Tool Design Many AI applications act on their own through connected tools, for example sending emails or querying databases. Application Vulnerabilities The software around the AI model, meaning its web interface, APIs and databases, has the same weaknesses as any other application.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

For 5 further use cases, relevance depends on the system design, for example whether it is connected through the Model Context Protocol (MCP). Show these use cases

Frequently asked questions

What is MCP Hijacking (Model Context Protocol)?
The Model Context Protocol (MCP) connects AI assistants to external tools and data sources in a standardised way. Attackers hijack MCP servers or manipulate their tool descriptions and thereby control what the AI system sees and does.
Which mitigations help against MCP Hijacking (Model Context Protocol)?
The catalogue lists 6 mitigations, each with control type, effect and implementation level. First among them are Authenticated MCP server connections, Tool manifest signing and verification and TLS-protected MCP transport.
Which EU AI Act obligations does MCP Hijacking (Model Context Protocol) touch?
The catalogue maps this threat to Art. 9 and Art. 14 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system and Build in effective human oversight. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“MCP Hijacking (Model Context Protocol)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/mcp-hijacking/

← Back to the full catalogue