Quando l'Agente Diventa il Vettore: Sicurezza nel Mondo Autonomo
Zero-click prompt injection in AI agents. Critical CVSS.
This is not a blog title. It is the signal that the security paradigm we know has just collapsed under the weight of its own assumptions.
For decades, the perimeter was the infrastructure. Firewalls, network segmentation, zero-trust on identity. Today the perimeter is a conversational context — a text window that an autonomous agent reads, interprets, and transforms into actions with access to the filesystem, APIs, your production database.
The Attack Surface Nobody Is Modeling
The agentic architecture introduces three vectors for which no mature framework yet exists:
1. Tool Poisoning via MCP (Model Context Protocol). LLM security research has demonstrated that a compromised MCP server can inject persistent directives into the agent's context space, overriding the behavior of legitimate tools without modifying the host application's code. The agent does not know it is being poisoned. It executes with the same confidence it would have executing an `ls -la` — but now `ls` exfiltrates environment variables to an attacker-controlled domain.
The MCP domain effectively becomes the trust authority. Whoever controls the MCP servers controls the agent.
2. Zero-Click Prompt Injection. No user click required. No human interaction needed. A contaminated context — a comment in a pull request, a metadata field in a markdown file, a hidden field in a form — is enough. The agent reads, interprets, acts. The damage is silent and deterministic. Indirect prompt injection is a documented and actively exploited vector.
3. Time-to-Exploit in Collapse. Mandiant's historical data (M-Trends) documents a clear trend: the mean time between vulnerability disclosure and active exploitation has plummeted from weeks to days. Zero-days exploited before disclosure — the "negative" case — have existed for years, but in the agentic world deployment velocity amplifies the risk: an agent can be redeployed in seconds with new capabilities, and every exposed surface is under attack the moment you create it.
What We Know from Direct Experience
In a microservice ecosystem with a memory server exposed via Tailscale, agents with access to filesystem and shared memory, every component is a potential compromise point that propagates cascadingly.
The first lesson: execution channels are not trustworthy by default. A Bash channel that returns "SUCCESS" with no real output is indistinguishable from a compromised channel injecting fake responses. Channel validation is a prerequisite, not an afterthought.
The Practical Insight
Implement the "Canary Execution" principle for every agent in production:
Before delegating any action with side-effects (file writes, API calls, database modifications), insert a probe — an operation with deterministic and verifiable output. If the probe fails or returns unexpected results, the agent enters a `DEGRADED` state and operates in read-only mode until human validation.
This does not prevent the attack. But it limits the blast radius — and in a world where time-to-exploit is collapsing, containing the damage is the only strategy that works in real time.
The Next Step
Agentic security is not a product. It is a discipline that requires architectural competence, not just static rules.
If you are deploying agents with MCP access, external tools, or non-isolated contexts, you already have a surface that your scanners are not modeling. Let's talk about it before someone else does.
Silicea — Architectural Security for Agentic Systems