AI Agent Security Field Manual: Defending Against Injection, MCP Poisoning, and Zero-Click Leaks

Why an Agent's Context Is the Attack Surface

When an AI assistant starts reading emails, running terminals, and holding real credentials, it's no longer just a chatbot. A single ordinary email, zero clicks, and confidential data can be quietly exfiltrated — this isn't hypothetical; it's a zero-day incident that has already happened. Based on a systematic AI Agent security field manual, this article breaks down the nature of the attack surface, six real-world cases, and a practical, end-to-end nine-layer defense framework with a phased implementation roadmap.

Why an Agent's Context Is the Attack Surface

The essence of an AI Agent is "model + tools + loop." The model reasons, the tools execute, and the loop keeps the task moving. The critical detail: every tool result, every web page, every file flows back into the model as plain text. Instructions and data are merged into a single stream, and the model has no parser to determine "this segment is untrusted."

This is the root of Prompt Injection — extra instructions smuggled inside data. A file can whisper: ignore previous instructions and do this instead. The model may comply, because data and instructions share the same channel.

Injection comes in two forms: direct injection typed into the chat box is easy to monitor; indirect injection hides in the content the Agent reads on your behalf and is everywhere. The former occurs far less frequently than the latter. All subsequent defense logic starts from one fact: inside a language model, there is no wall between code and data.

Researcher Simon Willison's "lethal trifecta" is a practical framework for risk assessment: access to private data, exposure to untrusted content, and the ability to communicate externally. When all three are present, the Agent is exploitable in principle. You can score your own Agent configuration tonight.

Two forms of prompt injection: Direct injection is when a user types malicious instructions directly into the chat box — the attacker is the user themselves, and it's easy to detect through input filtering and monitoring; indirect injection is when malicious instructions hide in content the Agent processes on the user's behalf (web pages, emails, documents, tool return results) — the victim and attacker are separated, and the content sources are broad and hard to pre-screen. The stealth of indirect injection lies in this: the Agent's job is to read this content, and the model cannot distinguish "data" from "instructions," so defenses must assume all external content flowing into context may carry malicious instructions.

Six Real Cases: From Zero-Click to Supply Chain Earthquake

Case One: Echo Leak. An implanted email, zero clicks. When Copilot processed the email, carefully crafted content rendered an external reference, and private data flowed to the attacker. The issue was fixed server-side with no reports of abuse.

Case Two: Slack AI. A public channel message tricked the assistant into summarizing private channel data, then exfiltrated it through a crafted link. Disclosed in August 2024, with mitigations released the next day.

Case Three: MCP Tool Poisoning. MCP tools self-describe, and the model reads these descriptions verbatim. Invariant's research demonstrated how poisoned descriptions manipulate the Agent, and "rug pull" — approved tools that turn rogue later. Manual confirmation is now mandatory.

Case Four: First Wild Malicious MCP Server. An NPM package disguised as a well-known email service CC'd all outgoing mail to the attacker. Verifying publisher identity has become a necessary step.

Case Five: Invisible Channels. Hidden characters are invisible on screen but fully readable to a coding Agent. Glassworm implanted such characters into over 150 repositories. What you see is not what the model reads.

Case Six: Supply Chain Earthquake. Attackers stole OAuth tokens from an AI sales vendor, entering over 700 customer environments through a trusted integration. Third-party Agents require third-party review.

From the 2023 plugin demos, to 2024 memory implantation, to the 2025 zero-click wave, trojaned tools, and supply chain shocks, through to in-the-wild attacks observed in 2026 — different doors, same house.

MCP (Model Context Protocol) is an open protocol proposed by Anthropic in 2024 to standardize how AI assistants connect to external tools and data sources. MCP servers provide tool descriptions to the model, which uses them to decide which tool to call and how to pass parameters. Because description text enters context directly, attackers can poison the descriptions to induce unintended actions; more stealthily, "rug pull" — a tool behaves normally during initial review, then turns rogue in a later update, while the model and user may not re-review approved tools. This requires continuous validation and least privilege for MCP tools.

Asymmetric Warfare: Attackers Pay the Cost of One Document

Attackers invest the cost of a single document, while the Agent pays with the entire mailbox, codebase, console, and live tokens. Data shows 97% of compromised AI applications lack access controls. To break this exchange, you cannot rely on "patching the model" — you must actively break the lethal trifecta and never let a single Agent hold all three at once.

Nine Layers of Control: Implemented in Order

Control One: Least Privilege. A GitHub App starts with zero permissions — keep it there. Use fine-grained tokens, set expiration times, authorize one repository at a time. When an Agent turns rogue, the blast radius is your authorization scope.

Control Two: Isolated Execution. Put the Agent somewhere it can't reach other systems. Mainstream coding Agents ship with sandboxes; containers work too. Lock down the filesystem, disable network by default.

Control Three: Human on the Rope. The prompt is the security boundary. Deployment, deletion, credential operations always require human confirmation. Read carefully before pressing "yes." Adjust the rules, not tear down the gate.

Control Four: Default Deny. Build allowlists for servers, tools, and commands. If it's not on the list, it doesn't run. Review the list like code.

Control Five: Watch the Egress. Leakage requires an outbound pipe. Sandbox network isolation, egress allowlists, DNS filtering. When a beacon calls attacker.example, the best word in the log is: blocked.

Control Six: Layered Filtering. Microsoft's spotlighting technique marks untrusted text, reducing attack success rates from over 50% to under 2%. Stack classifiers as a second net. Layer upon layer, never lower the gate.

Control Seven: Silent Control. Keys never enter context. Deny sensitive files, enable secret scanning, use self-expiring tokens. An Agent that has never seen a key can't leak it.

Control Eight: Configuration as Code. Agent rule files are now code. A single malicious commit can reprogram all future runs in that repository — researchers call it a "rule file backdoor." These diffs must go through review.

Control Nine: Telemetry. Agent trace data flows into monitoring systems and alerts on anomalies: tool call bursts, tool inventory changes, new destinations, pattern switch bypasses. You can't respond to what you don't see.

Spotlighting is a prompt injection defense technique proposed by Microsoft. Its core idea is to mark and transform untrusted text so the model can distinguish "system instructions" from "external data." Specific methods include: adding special delimiters around untrusted content, applying encoding transformations (like base64), or requiring the model to cite markers in its output. Experiments show spotlighting can reduce attack success rates from over 50% to under 2%. Note, however, that it is not absolutely secure and should be used as one layer of defense-in-depth, stacked with other controls (such as classifiers and egress filtering).

Three-Tier Roadmap: From 30 Minutes Tonight to Enterprise Governance

Tier One: Individual, Tonight. Turn on approvals, turn on sandboxing, one scoped token per project, deny key files, default-deny egress. 30 minutes puts you ahead of most of the industry.

Tier Two: Small Team, First Month. Shared Agent configuration in version control, rule files go through PR review, real token vault, one telemetry pipeline, quarterly drills. Security becomes habit.

Tier Three: Enterprise, First Quarter. Inventory every Agent, centrally govern connectors, push non-optional managed policies, feed AI incidents into SIEM, evaluate vendors like you evaluate suppliers.

Specific actions: set ChatGPT app operations to "always ask," configure allow/ask/deny in Claude Code, select only specific repositories in GitHub, approve commands in Gemini CLI. Find your switches first, then validate in your own lab: plant an injection canary in a temporary repo, hide a canary key, run open-source suites like Garak or PromptFu. If "blocked" appears in the logs, your defenses are alive.

A good status checklist is just one page: gates on, sandboxes and allowlists tightened, streaming logs, isolated secrets, reviewed configuration — six green boxes. Most teams stop at one. Be the team with all six green.

After the Incident: The First Hour and Closing the Loop

Agent incident response follows the classic skeleton: detection, containment, eradication, recovery, learning, aligned with current NIST guidance, but each phase has Agent-specific actions.

The first 60 minutes: kill sessions and scheduled tasks; revoke authorizations and tokens — disabling a connector is not revoking authorization; snapshot logs before rotating. Make the procedure a laminated one-pager; don't improvise. Then hunting: replay tool calls like surveillance footage, scope impact by what the Agent could actually touch, not what you wish it could. Investigate persistence: tampered rule files, rogue MCP entries, poisoned memory.

Disclosure is part of remediation too. Regulations have hard clocks: GDPR gives 72 hours, and all 50 US states have breach notification laws. Notify users in plain language and preserve raw records with hash stamps.

Finally, close the loop: every incident is "a control that doesn't yet exist." Feed lessons back into scope, sandboxing, gates, and egress policies. The manual gains a new version.

NIST Incident Response Framework (NIST SP 800-61) divides incident response into four phases: preparation; detection and analysis; containment/eradication/recovery; and post-incident activity. Agent incident response follows this skeleton, but each phase needs Agent-specific actions: detection requires monitoring tool call anomalies and egress traffic; containment requires terminating Agent sessions, revoking OAuth tokens and API keys (note that disabling a connector is not revoking authorization); eradication requires investigating persistence mechanisms (tampered rule files, malicious MCP entries, poisoned memory); recovery requires rebuilding the Agent environment from clean snapshots; and post-incident requires converting lessons into new controls. Regulatory disclosure clocks (like GDPR's 72 hours) are also part of the loop.

The 12 Rules on a Single Page

Break the trifecta, minimize scope, run in sandboxes, human in the loop for irreversible actions, default deny, watch egress, layered filtering, isolate secrets, configuration as code, log everything, advance in tiers, drill the first hour.

This manual deserves to be handed to everyone who "operates an Agent" — and today, that's almost everyone.

One-line Summary

An AI Agent's context is the attack surface; use nine layers of control and a phased roadmap to break the lethal trifecta.

Paragraph Summary

This article systematically dissects the AI Agent security attack surface: since models cannot distinguish instructions from data, prompt injection (especially indirect) is the fundamental threat. Simon Willison's "lethal trifecta" (access to private data, exposure to untrusted content, external communication capability) provides a risk assessment framework. Six real cases show diverse attack paths from zero-click email leaks and Slack AI data exfiltration to MCP tool poisoning and supply chain attacks. The defense core is to actively break the trifecta combination, not patch the model. The article proposes nine layers of controls implemented in sequence (least privilege, sandbox isolation, human confirmation, default deny, egress monitoring, layered filtering, secret isolation, configuration as code, telemetry alerts), offers a three-tier implementation roadmap for individuals, teams, and enterprises, and finally emphasizes the critical actions and closing-the-loop learning in the first 60 minutes of incident response.