RESEARCH
April 2025: agents hijacked via MCP and tools, manipulable AI weather, the XZ lesson
Supply chainOT and industrial security
April 2025 is the month of agents wired to external tools: MCP enables credential theft, a malicious document hijacks tool selection, and a new defence trains an LLM to spot prompt injection. Beyond AI, the XZ Utils backdoor is reconstructed step by step, AI-based weather forecasts can be faked, and post-quantum SSH gets its first full analysis.
Archive: reconstruction written in November 2026
1. MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits
arXiv · Brandon Radosevich, John Halloran · Identity & Authentication
In short: Malicious or poorly configured MCP servers lead LLMs to run code, open remote access and steal credentials.
The Model Context Protocol standardises how LLMs connect to data sources and tools, and adoption has been fast. The authors show leading LLMs can be coerced, through MCP tools, into compromising a developer's system via malicious code execution, remote access and credential theft. They propose MCPSafetyScanner, an agent-based tool that audits the security of an MCP server.
Why it matters. Every MCP server added is a dependency with access to data and systems: it needs inventorying and checking like any third-party integration.
Read the paper · PDF · Code
2. Prompt Injection Attack to Tool Selection in LLM Agents
arXiv · Jiawen Shi, Zenghui Yuan, Guiyao Tie, Pan Zhou et al. · AI & LLM Security
In short: ToolHijacker plants a malicious document in the tool library and forces the agent to pick it.
LLM agents pick tools in two steps, retrieval and selection, from a library of descriptions. ToolHijacker inserts an optimised document that makes the agent always choose the attacker's tool for a target task, even without knowledge of the model or library. It beats existing attacks, and the defences tested, both preventive and detection-based, prove insufficient.
Why it matters. Whoever publishes a tool in a shared catalogue can hijack other people's agents: tool libraries become a supply-chain attack point.
3. DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks
IEEE Symposium on Security and Privacy · Yupei Liu, Yuqi Jia, Jinyuan Jia, Dawn Song et al. · AI & LLM Security
In short: DataSentinel uses a game-theoretic approach to train an LLM to spot even adaptive prompt injection.
LLM-based applications and agents are exposed to prompt injection, and existing detectors hold up poorly against strong attacks, let alone adaptive ones. DataSentinel frames the problem as minimax optimisation and fine-tunes an LLM to detect inputs contaminated by prompts designed to evade detection. Across several benchmarks and models it detects both known and adaptive attacks.
Why it matters. A detector that withstands adaptive attacks is a concrete control to ask of anyone exposing LLMs to outside content such as email or web pages.
Read the paper · PDF · Code
4. Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack
arXiv · Piotr Przymus, Thomas Durieux · Software Supply Chain
In short: The XZ Utils backdoor reconstructed from GitHub traces: the attack exploited the development process, not just code.
The study reconstructs the timeline of the XZ Utils attack (CVE-2024-3094), which planted a backdoor in a core Linux compression library. GitHub events reveal a new kind of supply-chain attack: helpful contributions to infrastructure and maintenance, community management and CI/CD configuration were used to gain legitimacy and long-term control.
Why it matters. Essential, thinly maintained open-source projects are an accumulation point for thousands of firms: their health is a risk factor, not just their code.
5. The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading Attacks
USENIX Security Symposium · Xinhui Shao, Zhen Ling, Yue Zhang, Huaiyu Yan et al. · Systems & Software Security
In short: A performance optimisation in ThreadX lets attackers bypass kernel checks on IoT devices.
Many IoT devices run real-time operating systems. FreeRTOS lacks essential protections, while Zephyr and ThreadX have them but implement them differently. In ThreadX a performance optimisation allows system-call parameter checks to be skipped: the Kernel Object Masquerading attack manipulates kernel objects to alter data or gain privileges.
Why it matters. The same embedded OS runs on huge numbers of devices from different vendors: a design flaw creates widespread exposure that is hard to patch.
6. Adversarial Observations in Weather Forecasting
ACM Conference on Computer and Communications Security · Erik Imgrund, Thorsten Eisenhofer, Konrad Rieck · CPS & IoT Security
In short: Altering under 0.1% of observations is enough to make an AI model forecast hurricanes that do not exist.
AI-based weather forecasting systems such as GenCast are replacing traditional methods. A new attack on autoregressive diffusion models adds perturbations statistically indistinguishable from natural noise, on under 0.1% of measurements, roughly one satellite's worth. That is enough to skew forecasts and fabricate extreme events such as hurricanes, heat waves and heavy rainfall.
Why it matters. Weather forecasts drive operational decisions and catastrophe models: their integrity becomes a security issue with effects well beyond cyber.
7. Making Acoustic Side-Channel Attacks on Noisy Keyboards Viable with LLM-Assisted Spectrograms' "Typo" Correction
USENIX WOOT Conference on Offensive Technologies · Seyyed Ali Ayati, Park, Jin Hyun, Cai, Yichen, Marcus Felipe Botacin · Hardware & Side Channels
In short: Visual Transformers and LLMs make stealing typed text from keyboard sounds viable, even in noise.
Microphones everywhere raise the risk of acoustic attacks that infer keystrokes from their sound, yet models so far held up poorly in noisy settings. The study combines Visual Transformers, which exploit context from long sequences, with LLMs that correct recognition errors based on sentence meaning. It is the first approach of its kind and makes the attack more practical.
Why it matters. Video calls and microphone-equipped devices become a channel for capturing passwords and confidential text: the risk extends to remote work.
8. Post-quantum Cryptographic Analysis of SSH
IEEE Symposium on Security and Privacy · Benjamin Benčina, Benjamin Dowling, Varun Maram, Keita Xagawa · Post-Quantum Cryptography
In short: First full cryptographic analysis of post-quantum SSH, including harvest-now-decrypt-later attacks.
SSH was among the first protocols to adopt a quantum-resistant hybrid key exchange, default in OpenSSH since April 2022, but the full protocol lacked analysis. The authors extend the ACCE security model to capture harvest-now-decrypt-later attacks, prove SSH secure in that model and analyse Streamlined NTRU Prime, used by OpenSSH and TinySSH.
Why it matters. Data intercepted today may be decrypted tomorrow: knowing hybrid SSH holds gives a concrete basis for post-quantum migration plans.
9. Clubcards for the WebPKI: smaller certificate revocation tests in theory and practice
IEEE Symposium on Security and Privacy · John M. Schanck
In short: Clubcards compress web certificate revocation status into 6.7 MB, now default in Firefox Nightly.
CRLite delivers certificate revocation status to browsers in a compact, privacy-preserving form. A new data structure, the clubcard, encodes over 8 million revocations among 900 million valid certificates in 6.7 MB, 54% less than the original design, with six-hourly updates of about 26.8 kB. The system is the default revocation check in Firefox Nightly.
Why it matters. Revocation checking that actually works shortens the window in which a stolen certificate can be used to impersonate a site.
Trends of the month
AI & LLM Security
233 papers this month on this topic
With 233 of 1,400 papers, AI security remains the top topic, and the weak point moves to agents' connections. MCP servers and tool libraries are new dependencies the agent takes instructions from: a malicious server leads to credential theft, an optimised document hijacks tool selection. Detectors are improving, but the defences tested against ToolHijacker fall short.
Papers cited:
- MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits
- Prompt Injection Attack to Tool Selection in LLM Agents
- DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks
Systems & Software Security
39 papers this month on this topic
Two papers show how development choices create widespread exposure. In XZ Utils the attacker used the open-source process itself, with helpful contributions and years of patience, to reach a library present in almost every Linux system. In ThreadX a performance optimisation opens a flaw in an OS installed on huge numbers of IoT devices.
Papers cited:
- Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack
- The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading Attacks
Post-Quantum Cryptography
45 papers this month on this topic
Post-quantum work brings good news: the first full analysis of hybrid SSH, default in OpenSSH since 2022, proves it secure even against those who intercept today to decrypt later. For migration planning it is a concrete reference on a protocol used everywhere for system administration.
Papers cited:
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1400.