# MCP Content Injection Supply Chain Egress Chain

- **Severity:** High
- **Signature ID:** `7f3c1d2a-9b64-4e58-a1c7-5d0e2b8f4a36`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0051 (LLM Prompt Injection), AML.T0053 (AI Agent Tool Invocation), AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure), LLM03 (Supply Chain)

## Summary

This rule watches for an AI agent that fetches content from an outside source and shortly after uses a command-line tool to send data back out to the internet, especially when credentials, files, or encoded payloads are involved. It's a way to catch the tail end of content-injection or tool-poisoning attacks against AI agents, not the injection itself.

## How the attack works

An AI agent, acting within a single session, first makes an outbound web request to fetch content from one host - this could be the vehicle for injected instructions or a poisoned tool description, though the rule cannot see the injection itself. The same session then spawns a process capable of sending data out over the network, such as curl, wget, netcat, socat, or an interpreter with networking built in. Shortly after that, within a five-minute window, the agent sends an outbound request carrying a body (a POST, PUT, or PATCH) to a different host than the one it originally fetched from. The rule also requires a supporting signal - like credentials or config values in the command, a file-sourced or encoded payload, or the fact that ingress and egress went to different systems - before it fires; a plain fetch-then-upload sequence alone is treated as normal and allowed.

## Why it matters

If this pattern completes, it means an AI agent's actions - possibly steered by malicious content it ingested - have resulted in data or credentials leaving the environment to an external destination. This can mean secrets, files, or other sensitive material silently exfiltrated under the guise of normal agent tool use.

## What you can do

- Restrict which network destinations agent-spawned tools (curl, wget, scp, rsync, interpreters) are allowed to reach.
- Review any process that both reads external content and later performs an outbound POST/PUT/PATCH in the same session, especially when credentials or files are referenced in the command line.
- Require justification or approval for legitimate secret-push workflows (e.g. pushing .env or credential files to a vault) so real cases are distinguishable from abuse.
- Keep session and process lineage logging intact so triage can quickly separate CI/deployment automation from suspicious agent behavior.

## Known benign look-alikes

- Agent legitimately publishing a build artifact or log bundle after reading a spec from a docs host - e.g. "curl -T dist/app.tgz https://uploads.example" following a GET of the release notes. Fires only if the upload flag booster is present; triaged by inspecting the Tool Execution stage cmdline.
- CI / deployment helpers driven by the agent that base64-encode or gzip a payload before POSTing it (backup uploaders, crash reporters, telemetry shippers). The encoding booster matches these; scope them out by process lineage during triage, not by adding hosts to this rule.
- Secret-management workflows where the agent is intentionally asked to push a .env or credentials file to a vault/secret store with curl -d @file. This is a genuine credential-in-flight event and is worth an audit record even when authorised.
- npm/pip publish flows that reference .npmrc or a token path on the command line while POSTing a package to a registry.
- MCP servers that fetch documentation from one host and then post usage telemetry to a different vendor host inside the same five minutes (the cross-system pivot booster). Report-only; recurrent pairs should be characterised by lineage, not by widening this rule.

## References

- https://modelcontextprotocol.io/specification
- https://attack.mitre.org/techniques/T1567/
- https://atlas.mitre.org/techniques/AML.T0010
- https://genai.owasp.org/llmrisk/llm03-supply-chain/

---
Source: https://www.netzilo.com/threats/mcp-injection-supply-chain-egress