Metraipolis › archive › dc_cd25d412659e

Trust inversion and its exploitation: A threat model of the Model Context Protocol for agentic AI (2026) · DOI 10.46481/jnsps.2026.3748

Source: Metraipolis archive
Original: https://doi.org/10.46481/jnsps.2026.3748
License (as archived): CC-BY-4.0
Archived: 2026-10-07T11:38:11.213Z
SHA-256 of the archived text: 919a9c7e7c686b8b33095fc9750c4c30ee310087fdafafe8786358bb282f1d5d
Stable URL of this page: https://metraipolis.com/documento/dc_cd25d412659e

How to cite

Trust inversion and its exploitation: A threat model of the Model Context Protocol for agentic AI (2026) · DOI 10.46481/jnsps.2026.3748 — Metraipolis archive, https://doi.org/10.46481/jnsps.2026.3748 (CC-BY-4.0); archived copy: https://metraipolis.com/documento/dc_cd25d412659e (Metraipolis archive dc_cd25d412659e, sha256 919a9c7e7c686b8b33095fc9750c4c30ee310087fdafafe8786358bb282f1d5d)

BibTeX

@misc{dccd25d412659e,
  title = {Trust inversion and its exploitation: A threat model of the Model Context Protocol for agentic AI (2026) · DOI 10.46481/jnsps.2026.3748},
  howpublished = {Metraipolis archive},
  url = {https://doi.org/10.46481/jnsps.2026.3748},
  note = {License CC-BY-4.0; archived copy https://metraipolis.com/documento/dc_cd25d412659e; sha256 919a9c7e7c686b8b33095fc9750c4c30ee310087fdafafe8786358bb282f1d5d},
  year = {2026}
}

Archived text

Reproduced under CC-BY-4.0. Attribution: Metraipolis archive, https://doi.org/10.46481/jnsps.2026.3748. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Articolo recente con licenza aperta: scheda dai metadati Crossref (journal-article).
Titolo: Trust inversion and its exploitation: A threat model of the Model Context Protocol for agentic AI
Autori: Muhammad Qaim Aliyu Sambo, Augustine Yusuf, Ifeanyi Nwokoro, Abdulrahman Umar Sadiq, Victor Legbo Yisa
Pubblicato: 2026-09-21 · in: Journal of the Nigerian Society of Physical Sciences · editore: Nigerian Society of Physical Sciences
DOI: https://doi.org/10.46481/jnsps.2026.3748
Licenza dell'articolo: CC-BY-4.0

Abstract (testo degli autori, CC-BY-4.0):
The Model Context Protocol (MCP) standardizes connections between large language model applications and external tools and data. Its capability negotiation, dynamic discovery, insertion of tool results into model context, and server-initiated sampling create composition risks when server-originated artefacts influence actions executed under client authority. We define trust inversion as a condition in which an artefact crossing from a less-trusted MCP component into the client decision context is interpreted as operational authority without provenance-bound policy re-evaluation. The term is used as an MCP-specific analytical lens, not as a replacement for confused-deputy, indirect prompt-injection, control/data-plane-confusion, or transitive-authorization concepts. We construct an architecture-level threat model using three deployment profiles---local stdio, remote Streamable HTTP, and multi-server---together with STRIDE classification, explicit assets and security objectives, and a five-by-five likelihood--impact matrix. Publicly documented demonstrations, guidance-based attack classes, and an implementation CVE are coded by actor, preconditions, attack path, affected layer, violated property, and candidate controls. The analysis groups risks into descriptor and capability drift, cross-tool trust propagation, and sampling-mediated server influence, while separating protocol, ecosystem, implementation, and deployment weaknesses. We propose immediately deployable controls, including transport authentication, least privilege, trust-zone separation, schema validation, sandboxing, and audit logging, and distinguish them from extensions requiring standardization, including signed capability manifests and re-attestation. The resulting checklist is a threat-modelling aid; its mitigation effectiveness remains to be established through prototype implementation, red-team testing, and deployment-specific evaluation.

Fonte: https://api.crossref.org/works/10.46481%2Fjnsps.2026.3748 — metadati Crossref, consultati il 2026-10-06. Interrogazione: «model context protocol».