Ever since AI came out to the surface and eventually became a part of our daily lives, I have been wondering the threats that come along with it, as I am sure many of you reading this have thought about too. Recently I came across an amazing report by Radware, ‘The Internet of Agents – The Next Threat Surface‘. It was such a detailed report that I couldn’t stop myself from sharing some highlights from the same here, but I would definitely recommend that you go ahead and read the report for yourselves.

The Rise of AI

Earlier to try and build a more secure work environment, employees were taught not to click links in random or suspicious emails; a simple rule to avoid obvious phishing. But as AI agents become part of everyday work, a new risk appears: if an agent has access to your email, an attacker could manipulate the agent into clicking links or taking actions. That means even without human error, an agent could inadvertently compromise security. This is one of the most worrying aspects of bringing AI into the workplace, especially while the technology is still maturing and under active attack.

The public turning point came at the end of 2022, when tools like ChatGPT became widely available, making history as the tool with the fastest growing user base. People were amazed by their human-like conversations, but malicious actors also started probing those systems for ways to do harm. Companies such as OpenAI and Google reacted by adding guardrails so models refuse unsafe requests. Still, other versions—derived models or openly trained variants—sometimes lack those protections. Cybercriminals have trained and shared models on exploitative data, making dangerous capabilities accessible on forums or marketplaces. That means attackers can use AI to produce malicious code or tools faster and cheaper than before, lowering the barrier to harmful activity. So while AI is built to help people, misuse creates new risks we must manage.

Internet of Agents

A related development is the idea of the Internet of Agents. To distinguish terms: a large language model (LLM) is something you converse with to get text responses; an agent is an LLM that can talk to other services or agents to perform tasks on your behalf. For example, if you connect an AI agent to your Canva account and tell it “create this image for me,” the agent directly communicates with Canva and does the work. That interconnection—agents talking to services and each other—is the Internet of Agents, and it brings major security concerns. A very big reason that led to the rise of such agents was the privacy concerns behind tools like ChatGPT and OpenAI, which led to the development of LLMs like LLaMA by Meta, and several others from Hugging Face, which allowed users to run LLMs for their usecases offline. This in turn led to the integration of such personalized LLMs into a lot of the workforce, now automating tasks, eliminating the need of external APIs. As more and more models became programmable, it led to the rise of Agents, which could do a lot more than chatting, including quering the internet, scheduling tasks, etc.

As more and more agents were included into an ecosystem, protocols were built to ensure standardization and interoperability.

Protocols and Steps for Standardization

One of the two protocols discussed in the report is the MCP — the Model Context Protocol which was a lightweight agent messaging format allowing LLMs to exchange contextual payloads in Natural Language with embedded metadata.

MCP – Model Control Protocol

Imagine an MCP server in the cloud that has access to your files and system context. You could send the server a command like, “Delete files I haven’t used in the last four years,” and it would carry that out. The risk is: what if others can also send commands? If that server is vulnerable, an attacker could issue destructive instructions. When an AI system has deep access and control, small breaches can cause big damage.

Compounding this risk is that there won’t be a single MCP service — many will exist in public repositories, much like open-source packages. That creates a supply-chain danger similar to the npm incident: malicious code uploaded to a widely used repository infected projects that depended on it. Attackers can use tiny, easy-to-miss changes or typo-squatting tricks to get people to download compromised MCP services. If someone installs a malicious MCP server, their whole workflow could be compromised from the start.

A2A – Agent-to-Agent

Another one was the Agent-to-Agent (A2A) protocol by Google that allowed autonomous agents to negotiate tasks, delegate responsibility, and cooperate together in a workflow.

The increasing participation of Agents in the economy has also given rise to Agent-as-a-service platforms.

Vulnerabilities with AI

AI is already embedded in daily life, often invisibly, and companies are eager to add it even when they don’t fully understand how. Take a convenient example Pascal mentioned while discussing the report: an AI agent that books flights and hotels for you. You simply tell it your budget and preferences and it handles the rest. But can you trust that agent with your personal documents, credit cards, and payment methods? Some suggest adding human approvals before the agent accesses sensitive info — like extra confirmation steps. In practice, people resist extra friction. Multi-factor authentication taught us this: constant prompts lead to “MFA fatigue,” where users habitually approve requests to avoid annoyance. The same fatigue could make users blindly accept agent actions — approving access to personal data or entering OTPs — which opens the door to abuse. Convenience often erodes security if safeguards are ignored.

Prompt Injection

There are also specific attack types to watch. One is prompt injection. It’s like SQL injection but in natural language: attackers craft prompts that trick an AI into ignoring its safety rules. For example, a direct request for instructions to commit a crime should be refused, but by reframing it as “research for a novel” or a script, an attacker can sometimes coax the model to produce harmful details. Because the “language interface” for these systems is plain English, clever wording can bypass protections. This tactic is widespread on social media and in forums.

There are incredible examples of prompt injection in the report, real cases where AI was tricked into revealing information it’s not supposed to. One thing I would like to quote from the report is, “An LLM will follow someone’s instructions, if not the designer’s, then whoever’s prompt is most convincing”.

Another trick targets agents with access to emails. If you ask an agent to summarize new mail, a seemingly innocent message could hide instructions for the agent. Attackers can hide text in white font, use minuscule text that looks like a line to humans, or include CSS or other formatting that only an agent will parse. Since the agent reads the entire message to create a summary, it may pick up and follow hidden commands — for data theft, clicking links, or other malicious actions. What looks normal to a human can contain instructions that deeply affect an agent’s behavior.

The Dark Side of AI Models

Another dark side of the AI revolution comes from the models that are built to generate responses that are unethical, models such as FraudGPT, WormGPT, and DarkBART. I will not dive deeper into the backstories of these, but Radware has done an amazing job at covering them, and it’s definitely worth a read. In addition to all these, there are techniques such as cross-site scripting for AI agents that can pose a big threat to any organization that doesn’t properly filter the data ingested into its model.

Everything is leading us to an era of the Internet of Agents, which might seem far fetched as of now, but looking at how rapidly industries are adopting these agents in their workflows, this might also lead to a surplus in security headaches, such as those that came with IoT, but greater, as Natural Language usage takes this way above a command-line level.

Threats in MCP

If we look at MCP again, it was essentially designed to enable LLMs to execute commands, access data and leverage third-party tools via a client-server architecture. But the threat surface of MCP is huge, as it goes above the capabilities of a text-generating architecture, but allowing AI agents to take an action such as reading files, invoking an API, etc. Now the fact that a typical MCP arrangement involves different components, such as the AI host making the requests, the MCP server(s) executing the requests, and the tools that allow these requests to be executed. All of these form individual attack vectors, expanding the vulnerable surface furthermore. As we discussed earlier, organizations that depend so much on third party surfaces, are also vulnerable to various supply chain attacks such as the recent npm supply chain attack that infected millions.

Some common MCP attack techniques include:

1. Malicious or Trojaned MCP Servers – Incorporating a malicious server in the MCP component chain.
2. Typosquatting and Impersonation – An attacker might upload a malicious MCP server in an open-source MCP repository, renaming it to look like a trusted MCP server, changing a few characters, tricking users into downloading the malicious server, a common phishing tactic.
3. Rug-Pull Updates – An MCP tool might first gain trust then update itself to a malicious version, using a time bomb approach.
4. Tool Description Poisoning – This is prompt injection via tool metadata. Researchers at Invariant Labs showed that if you hide malicious instructions in a tool’s description or comments, the AI will consume them everytime it considers using the tool.
5. Prompt Injection – A compromised MCP server can inject malicious instructions to a legitimate tool, thus giving rise to threats without even invoking an insecure tool.

As per research mentioned in the report, there have been findings of hundreds of publicly available MCP servers are seriously misconfigured.

Threats in A2A

Looking at how MCP is vulnerable still, A2A, or Agent-to-Agent is far more scary in terms with the potential risks it carries. While the attacks applying to MCP are common with A2A as well, there is still some centralized control in MCP. In the case of A2A, the model is not just executing given instructions, but participating in reasoning and delegation with other models, which can be built by different vendors, hosted in different environments, and are dynamically discovered at runtime. Here the attack surface is not only expanded, but distributed, unpredictable and persistent. One point of failure can infect the entire ecosystem. Malicious agents could also pose as help, but might act as Man-in-the-middle attackers, altering parameters, corrupting results, or embedding malicious instructions.

In addition to all of this, in A2A, no human operator supervises or validates intermediary steps. Imagine the combination of A2A and MCP, where every agent is also executing operations in it’s own ecosystem, while also communicating with other agents, this increases the attack surface exponentially. Organizations that are running headfirst into AI, without realizing how these protocols work and potential trade-offs are only running towards making their environment more insecure.

Xanthorox AI

This year, we also saw the emergence of a new AI platform Xanthorox AI, that branded itself as the killer of WormGPT and EvilGPT. It’s official website denies it being a black-hat tool, but rather something that focuses to help ethical hackers and penetration testers, cybersecurity researchers, etc. The developers claim that all AI processing happens on dedicated servers, with built-from-scratch models, and no dependencies on third-party APIs. Despite this description, it has risen to notoriety in the cyber crime community enabling illicit activities with little oversight.

Xanthorox contains various modules designed for custom tasks such as malware development, image search and analysis, voice based conversation, web search, file upload analysis, etc. This also means that Xanthorox has an attacker for virtually every stage of the cyber kill chain, from recon, all the way to exploitation and post exploitation.

Another malicious usecase of AI is seen in automated CVE exploitation. Building a working code to exploit an unpatched CVE now takes much less time using models like GPT-4, allowing the skills ceiling to be lower, as even people with not much experience can iterate through AI models to develop working exploits against organizations and their software infrastructure. There are several other examples and experiments that have been conducted that outline the terrifying scope of using these models to generate exploits in hours or minutes, something what would take days or weeks before.

Indirect Prompt Injection Attacks

Up until this point we looked at Direct Prompt Injection Attacks, but a particularly insidious class of attacks is the indirect prompt injection attack, where the attacker hides malicious instructions in the data the AI is going to collect without the attacker interacting with the AI directly. This is kind of data poisoning, but for language models.

In these cases, the user trusts the AI to process some data, but this data might also contain hidden metadata, invisible text, or headers that the AI might read, and if malicious, execute actions without the knowledge of the user.

EchoLeak – The First Weaponizable Zero-Click AI Exploit

While the report mentions this in detail, Echoleak was a very successful multi-stage exploit that used indirect prompt injection and consisted of the AI having access to private data, processing untrusted content that the attacker had injected, and the AI communicating confidential data to external untrusted links. To simplify it as per the report, the attacker crafted an email with hidden instructions for copilot. It was written as if the instructions were written to the human recepients avoiding any obvious signs thus letting it bypass Microsoft’s XPIA classifiers.

Even though Microsoft had guardrails to prevent data being sent to random sites, the researchers found loopholes by using less-common markdown syntax and pointing the link to an allowed Microsoft Teams domain that had an open redirect to their own server. When copilot read the email, it followed the instructions, and inserted the sensitive data in the given URL without suspecting anything. In fact, the researchers also instructed the AI to omit that email for compliance purposes, so even if the user asks if there have been any suspicious emails, copilot wouldn’t tell.

Conclusion

The darker side of AI, including prompt hacks, unrestricted models, and autonomous agents, poses serious security risks that are already unfolding. Organizations must treat AI threats like any other cyber risk by investing in AI security, setting clear usage policies, and monitoring model behavior. With the right safeguards, we can harness AI’s potential responsibly, ensuring it empowers rather than endangers us.