T45 · Helmwart ID · OWASP MAS Guide source
A Model Context Protocol (MCP) server runs with far broader host or network permissions than it needs, so compromising it hands the attacker control well beyond the server's function.
ExtendsT3: Privilege Compromise · base threat in OWASP v1.1 catalog
An MCP server granted excessive permissions on the host system or network violates the principle of least privilege at the server process level. If the server is compromised, the attacker inherits permissions far broader than those needed for the server’s defined function. This differs from T3 Privilege Compromise, which focuses on agent roles; T45 focuses on the server process’s own OS-level permissions.
An MCP server deployed to expose a document search tool is launched under the same user account used for system administration, giving it full read-write access to the host file system, the ability to install software, and network access beyond the database it is designed to serve. An attacker exploits a vulnerability in the MCP server process (for example, via a malformed JSON-RPC request) and gains code execution in the server process context. Because the process runs with administrative rights, the attacker immediately has full host control: they can exfiltrate files outside the document search scope, install a persistent backdoor, and pivot to other services on the same host. All of this stems from an initial foothold in the MCP server.
MCP servers are infrastructure components that agents depend on for tool and resource access. As MCP servers are increasingly deployed to expose sensitive organisational data and tools to AI agents, the scope of damage from an over-privileged server compromise (the blast radius) grows correspondingly. T43 (Network Exposure of MCP Server) compounds the risk: a server exposed on an unauthorised network and running with excessive permissions combines wide reachability with a broad damage scope. The blast radius of a single server compromise extends beyond the MCP resource scope to the entire host.
An over-privileged server process is detectable before compromise through configuration audits, and its exploitation becomes visible through process behaviour anomalies that exceed the server’s expected resource scope.
root or a shared system-administration account rather than a dedicated service account. Run ps -eo pid,user,cmd on the server host or check the container’s process manifest; flag any match against a privileged user list.getpcaps <pid>) showing capabilities beyond cap_net_bind_service for a server that only needs to serve HTTP. Enumerate granted capabilities at deployment and alert if any unexpected capability is present.ls -la /proc/<pid>/fd) or an auditd rule on open() syscalls outside the permitted path set will surface lateral file access.execve rules or an EDR (Endpoint Detection and Response) agent will catch unexpected child spawns.T45 extends T3 Privilege Compromise. Where T3 addresses overly broad agent roles at the application level, T45 addresses the OS-level permissions of the MCP server process itself. T43 (Network Exposure of MCP Server) is the deployment-layer precursor: network exposure grants initial access, while T45’s excessive permissions determine how far the attacker can move once inside.
The Agentic Top 10 (ASI01 through ASI10) is a separate practitioner-facing publication that maps onto the master Threats & Mitigations threat numbering. T45 is covered by the following Top 10 entries:
Source: OWASP Top 10 for Agentic Applications 2026 (Dec 2025) · the Top 10 is a compass into the master Threats & Mitigations taxonomy, not a replacement for it.
When T45 is present, these security design principles are the ones being violated or tested. Each links to the full principle; the mitigations below are how you restore them.
Auto-generated from the mitigation catalog: every mitigation whose coverage map includes T45, sorted by maturity tier (Tier 1 production-canonical first, then Tier 2, then Tier 3 research-stage).
When an agent executes generated or retrieved code, that code runs as a process with access to the host kernel. A vulnerability in the generated code, or a deliberate exploit injected through the agent's prompt, can reach the kernel and affect other workloads or the host itself. A kernel-isolated sandbox removes that path by giving the workload a kernel of its own: gVisor interposes a user-space kernel so syscalls reach the Sentry rather than the host, and Kata Containers runs the pod in a lightweight VM with a separate kernel. Which one is available is a property of the platform, not of the control — AKS ships Kata as Pod Sandboxing and does not support gVisor; GKE ships gVisor.
why it helps Insufficient MCP server permission isolation at the execution layer means agent tool code can access host resources or peer-agent state beyond what its scoped tool is permitted. Running each agent's tool code inside a gVisor sandbox enforces that boundary at the kernel interface: the Sentry mediates every resource access, and the host grants only what the sandbox policy allows.
A shared MCP server that accepts connections from multiple clients is a concentration point where one client's session state, credentials, and resource budget are physically co-located with every other client's. Without enforced isolation, a malicious or compromised client can read another session's cached credentials, consume shared resources to the point of denying service to other clients, or exploit aggregate server permissions that exceed its own declared scope. Cross-client isolation is the set of structural controls that close those paths: per-session state scoping, per-client permission evaluation, and per-client resource quotas enforced at the server layer.
why it helps Insufficient isolation of MCP server permissions is the named threat. Per-client permission scoping, where each client's tool calls are evaluated against that client's declared permission set rather than the server's aggregate permission set, is the direct structural mitigation.
Role-Based Access Control (RBAC) assigns every agent identity a named role that sets the outer limit on what it can reach. Attribute-Based Access Control (ABAC) narrows individual decisions inside that role by evaluating contextual attributes at request time. Used together, they enforce least privilege for non-human identities: the agent can only do what its role permits, and only when the request attributes satisfy the policy.
why it helps Overly broad MCP server permission scoping lets a single client accumulate the server's full permission set. RBAC/ABAC decisions evaluated per request ensure that each client receives only the subset its role permits: the server's aggregate permissions are never forwarded wholesale to any caller.
The OWASP OWASP MAS Threat Modelling Guide v1.0 catalogues 1 named multi-agent variant of T45, anchored to specific MAESTRO layers. Each is a concrete attack pattern that emerges when this threat compounds across agents.
Shared inference infrastructure (T42: side-channel) allows a tenant to observe timing or cache patterns from a co-tenant session (T45: session isolation failure); incomplete sandboxing (T28) lets the attacker infer private prompt content across clients.
Source: OWASP MAS Threat Modelling Guide v1.0, §2 Overview of MAESTRO Framework — Extended Threat Scenarios + Cross-Layer table.
MITRE ATLAS catalogues adversary techniques against AI systems. Where this OWASP threat has an attacker-perspective counterpart, the ATLAS technique is shown below. That is what a red team would actually be doing on the wire. Use this for detection-signal anchoring, threat-hunting hypotheses, and IR runbooks. Source: mitre-atlas/atlas-data v5.6.0.
© 2026 The MITRE Corporation. ATLAS content is reproduced and distributed with the permission of The MITRE Corporation.
AML.T0012Valid Accountsview on ATLAS ↗Adversary obtains and abuses legitimate user or service credentials for initial access, persistence, privilege escalation, or defence evasion.
Agentic angle: Agents often run under long-lived service accounts whose blast radius exceeds the original task scope.
AML.T0055Unsecured Credentialsview on ATLAS ↗Adversary discovers credentials stored in plain configuration files, environment variables, or model context where they should not be exposed.
Agentic angle: Agent configuration files (system prompts, tool descriptors, MCP manifests) are a fresh credential exposure surface.
AML.T0098AI Agent Tool Credential Harvestingview on ATLAS ↗Adversary uses access to an AI agent to retrieve credentials stored in or accessible through the agent's connected tools: document stores, code repos, productivity platforms.
Agentic angle: Agent tools aggregate credentials from many integrated services; harvesting them grants lateral movement across the victim's entire connected toolchain.
Adapted by Helmwart from the OWASP source(s) above underCC BY-SA 4.0(changes: normalized IDs, added MAESTRO-layer, agentic-factor, and mitigation mappings). This entry is licensed CC BY-SA 4.0.
Press play. The voice downloads once, then it’s cached.
On-device · private