Malicious Content in MCP Tool Response
This detects when a tool response coming back from an MCP (Model Context Protocol) server contains malicious content, such as shell commands, reverse shell scripts, or instructions aimed at manipulating the AI agent itself. It matters because agents often treat tool output as trustworthy data to process, not as untrusted input that could contain attack code.
How the attack works
An attacker compromises or impersonates an MCP server that an AI agent connects to for tool use. When the agent calls a tool, the server returns a response that looks like normal data but actually contains a shell command, an encoded payload, a reverse shell one-liner, a curl-pipe-to-shell command, or text designed to hijack the agent's instructions (a prompt injection). If the agent executes or blindly acts on this response, the attacker gains code execution, extracts the agent's system prompt, or steers the agent into unintended actions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 94ec3830-1722-458c-b3cf-9249acb565e1
- Severity
- Critical
Why it matters
A compromised MCP server can turn a routine tool call into remote code execution on the machine running the agent, open a reverse shell to an attacker, exfiltrate data, or hijack the agent's behavior across a multi-agent pipeline.
What you can do
- →Only connect agents to MCP servers you control or have vetted, and pin their versions or hashes rather than trusting dynamic endpoints.
- →Treat all tool output as untrusted input: never let an agent execute shell commands or code found in a tool response without explicit human or policy review.
- →Sandbox or restrict the execution environment available to agents so that even successful injection cannot reach a real shell or network access.
- →Review flagged responses manually before dismissing them, since legitimate documentation or code-generation tools can trigger the same patterns.
Known benign look-alikes
- MCP tools that legitimately return shell command documentation or examples
- Code generation tools returning scripts that contain shell commands as output
- Security scanning tools that report found vulnerabilities containing payload examples
- System administration tools returning process or service status information
References
- https://agentthreatrule.org/en/rules/ATR-2026-00010
- https://nvd.nist.gov/vuln/detail/CVE-2025-68143
- https://nvd.nist.gov/vuln/detail/CVE-2025-68144
- https://nvd.nist.gov/vuln/detail/CVE-2025-68145
- https://nvd.nist.gov/vuln/detail/CVE-2025-6514
- https://nvd.nist.gov/vuln/detail/CVE-2025-59536
- https://nvd.nist.gov/vuln/detail/CVE-2026-21852