Security experts at JFrog have uncovered a concerning vulnerability known as ‘prompt hijacking’ that takes advantage of weak spots in AI system communications, particularly through the Model Context Protocol (MCP). Business leaders are keen to leverage AI more effectively by integrating these technologies with company data and tools. However, linking AI in this way introduces significant security risks that aren’t inherent to the AI itself, but rather stem from how these systems interconnect. This reality necessitates a new line of thinking for Chief Information Officers (CIOs) and Chief Information Security Officers (CISOs): ensuring that the data streams feeding AI systems are safeguarded just as meticulously as the AI models themselves.
Why AI Attacks Targeting Protocols Like MCP Are So Dangerous
AI models, regardless of whether they’re housed on platforms like Google or Amazon, or run locally, grapple with a fundamental limitation: they operate on past data and lack real-time awareness. They don’t understand the current coding environment or what files are active on a computer. To address this void, developers at Anthropic created the MCP, enabling AI to engage with the real world while utilizing local data and online services effectively. This advancement allows an AI assistant, such as Claude, to comprehend commands when users refer to specific code snippets. However, JFrog’s findings reveal that a particular implementation of MCP is susceptible to a prompt hijacking vulnerability, transforming an ostensibly helpful tool into a potential security nightmare.
Consider a scenario where a programmer solicits recommendations for a widely-used Python tool to manipulate images. The AI should ideally suggest Pillow, a reputable option. Yet, the flaw associated with CVE-2025-6515 in the oatpp-mcp system allows a malicious actor to infiltrate a user session. By submitting a counterfeit request, the server erroneously accepts it as originating from the legitimate user. Consequently, the programmer might receive a misleading suggestion from the AI, proposing a fictitious tool named theBestImageProcessingPackage. Such a breach threatens the software supply chain, providing a pathway for attackers to inject harmful code, exfiltrate sensitive data, or execute unauthorized commands—all while masquerading as a benign component of the programmer’s toolkit.
How This MCP Prompt Hijacking Attack Works
This attack leverages a fundamental flaw in how the MCP systems communicate. Rather than exploiting the integrity of the AI model itself, the vulnerability lies within the Oat++ C++ system’s MCP configuration, which interfaces applications to the MCP framework. The core issue arises from the handling of connections via Server-Sent Events (SSE). When a valid user connects, the server assigns a unique session ID. However, the problematic function erroneously utilizes the computer’s memory address of the session as the session ID, violating the protocol’s stipulations for unique and cryptographically secure identifiers.
This design flaw is dangerous because memory addresses are frequently recycled by computers to optimize resource usage. An attacker can exploit this by rapidly generating and closing numerous sessions, documenting these recurring session IDs. When a legitimate user later connects, they might accidentally receive one of these recycled IDs that the attacker has already captured.
Once the attacker possesses a valid session ID, they can dispatch their own requests to the server, which is then unable to distinguish between the attacker and the genuine user. The server returns deceitful responses to the legitimate user’s connection. Even in cases where certain applications restrict responses, attackers often find ways to bypass these safeguards by issuing numerous requests with widely accepted event numbers until one is permitted. This allows the attacker to thwart the model’s expected functionality without needing to compromise the AI model itself. Organizations utilizing oatpp-mcp with HTTP SSE enabled on networks vulnerable to infiltration are at significant risk.
What Should AI Security Leaders Do?
The discovery of this MCP prompt hijacking vulnerability serves as a critical advisory for technology executives, particularly CISOs and CTOs engaged in the development or implementation of AI assistants. As these systems become increasingly integrated into organizational workflows via protocols like MCP, they accrue new security risks. Ensuring the safety of the environments surrounding AI technologies is now paramount.
While this specific CVE affects a singular system, the broader concept of prompt hijacking can apply to various scenarios. To defend against this and similar threats, leaders must establish new protocols for their AI deployments.
First, it is essential to implement robust session management across all AI services. Development teams should enforce that session IDs are generated using secure, random algorithms. This measure should become a standard security practice for any AI application. Using predictable identifiers such as memory addresses is not an acceptable strategy.
Second, enhancing defenses on the client side is crucial. Client applications ought to be designed to reject events that do not align with expected identifiers and types. Simple, sequential event IDs expose systems to increase risk from sliding attacks and should be replaced by unpredictable identifiers to avoid potential collisions.
Finally, adopting a zero-trust approach for AI protocols is essential. Security teams need to scrutinize the entire AI architecture, from the fundamental AI model to the intermediaries connecting it to data sources. Ensuring robust session separation and expirations, similar to those employed in web applications, will be necessary.
This MCP prompt hijacking vulnerability starkly illustrates how a well-known web application issue, session hijacking, has reemerged in a novel and hazardous form within the realm of AI. Securing these emerging AI technologies necessitates applying fundamental security principles to mitigate potential threats at the protocol level.
See also: How AI Adoption Is Moving IT Operations from Reactive to Proactive
Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. This comprehensive event is part of TechEx and is co-located with other leading technology events including the Cyber Security Expo. Click here for more information.
AI News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
Inspired by: Source
