Servant, Stalker, Predator: How An Honest, Helpful, And Harmless (3H)
  Agent Unlocks Adversarial Skills
Authors: name: David Noever

This paper identifies and analyzes a novel vulnerability class in Model
Context Protocol (MCP) based agent systems. The attack chain describes and
demonstrates how benign, individually authorized tasks can be orchestrated to
produce harmful emergent behaviors. Through systematic analysis using the MITRE
ATLAS framework, we demonstrate how 95 agents tested with access to multiple
services-including browser automation, financial analysis, location tracking,
and code deployment-can chain legitimate operations into sophisticated attack
sequences that extend beyond the security boundaries of any individual service.
These red team exercises survey whether current MCP architectures lack
cross-domain security measures necessary to detect or prevent a large category
of compositional attacks. We present empirical evidence of specific attack
chains that achieve targeted harm through service orchestration, including data
exfiltration, financial manipulation, and infrastructure compromise. These
findings reveal that the fundamental security assumption of service isolation
fails when agents can coordinate actions across multiple domains, creating an
exponential attack surface that grows with each additional capability. This
research provides a barebones experimental framework that evaluate not whether
agents can complete MCP benchmark tasks, but what happens when they complete
them too well and optimize across multiple services in ways that violate human
expectations and safety constraints. We propose three concrete experimental
directions using the existing MCP benchmark suite.