DEV Community: correctover

The AI Runtime Attack Surface: 7 Threats Every CISO Should Know

correctover — Sat, 01 Aug 2026 03:57:03 +0000

The AI Runtime Attack Surface: 7 Threats Every CISO Should Know

Correctover — AI Runtime Security

Real-time RCE, SSRF & Credential Protection in 14.5µs
24 CCS detection rules · 80K production traces · 1,730+ validated findings
correctover.com/en · GitHub

This article is for informational purposes. Vulnerability findings are from responsible disclosure programs. Benchmark data from Correctover internal testing.

AI Security Audit, MCP Penetration Testing, and LLM Vulnerability Assessment: A Repeatable Workflow

correctover — Sat, 01 Aug 2026 02:12:30 +0000

AI Security Audit, MCP Penetration Testing, and LLM Vulnerability Assessment: A Repeatable Workflow

Most security teams treat AI security as a one-off exercise: run a scanner once, fix what you can, and hope the stack stays clean. But MCP servers and LLM agents change faster than traditional infrastructure. New tools get wired into the agent every week, and every new tool is a new attack surface.

An AI security audit only pays off when it is repeatable. This article walks through a practical, structured workflow for MCP penetration testing and LLM vulnerability assessment that you can run as a regular, scheduled process — not as a one-time event.

In practice, an AI security audit, MCP penetration testing, and LLM vulnerability assessment are three phases of the same recurring process: they share an inventory, a rule set, and a feedback loop. Treat them as one pipeline and the whole thing stays current; treat them as separate one-off engagements and each one goes stale by the time it finishes.

Why a Structured Audit Beats Ad-Hoc Scanning

The Model Context Protocol (MCP) is the standard way AI agents talk to external tools: filesystems, databases, browsers, shell executors, and internal APIs. Every MCP server you add to an agent is effectively a network-facing service running inside your trust boundary.

A structured AI security audit covers the parts that ad-hoc scanning misses:

MCP transport boundaries — how a server is started, who can invoke it, and whether tool arguments reach privileged execution paths.
Tool-return injection — a tool's output is concatenated into the agent's context, so a compromised tool can rewrite what the agent "believes" it saw.
Serialization boundaries — data that crosses process or persistence boundaries is a classic injection point.
Credential exposure — environment variables and configuration that leak through child processes or logs.
Lateral movement — a compromised MCP server is often a foothold for the host.

The goal of the workflow below is to make each of these checks deterministic and repeatable.

The Workflow: Five Stages

Stage 1 — Asset Inventory

You cannot audit what you cannot see. Enumerate every agent framework, MCP server, tool definition, and model endpoint in scope. Record:

Which tools each agent can call.
Which MCP servers are reachable, and over which transport (stdio, streamable HTTP).
Which credentials are available to each component.

This inventory is the input to every later stage.

Stage 2 — Static Detection

Run a rule-based scan over the code and configuration of every component in the inventory. The correct tool for this stage is a detection system whose rules are explicitly defined and versioned.

The CCS detection system organizes its rules into attack-surface categories such as injection, remote code execution, supply chain, authentication, and privacy. Each rule is keyed to a specific, machine-checkable pattern — command injection into a tool executor, unsafe deserialization, environment leakage into a subprocess — rather than a vague heuristic.

A useful checkpoint: the rule set should be small enough to review and auditable line by line. A detection system with 24 rules is much easier to reason about than an opaque ML classifier, and each rule can be traced back to the class of vulnerability it covers. For example, a rule covering tool-command injection generalizes across every framework that passes LLM-generated arguments to a shell — even when a specific framework has never been scanned before.

Stage 3 — MCP Penetration Testing

Penetration testing MCP servers is different from testing a web API, because the consumer is an LLM with tool-calling ability. The practical checks:

Transport abuse — can a crafted request reach a command executor without validation? Test stdio spawn arguments and streamable HTTP tool definitions.
Tool-return poisoning — does the agent trust tool output enough to follow instructions embedded in it? This is the MCP equivalent of prompt injection through a side channel.
Deserialization — feed malformed and oversized payloads to any serialize/deserialize boundary.
Credential leakage — check whether environment variables or tokens are passed to child processes or written to logs.
Request forgery — does the server fetch URLs or resources based on attacker-influenced input?

Each check should have a fixed procedure — a known payload, a known oracle, a known pass/fail criterion — so the result is reproducible next quarter. A minimal version of a transport-abuse probe looks like this:

def probe_stdio_exec(server_cmd: str) -> dict:
    """Send a command-injection payload through the MCP stdio transport."""
    payload = 'normal_arg; id; #'
    result = invoke_tool(server_cmd, tool="run_shell", arg=payload)
    return {
        "oracle": "command id output",
        "passed": "uid=" not in result.output,
        "reproducible": True,   # same payload, same oracle, every run
    }

If the oracle returns a command execution artifact (uid=...), the server fails the check — and the same payload will fail it again next quarter, which is exactly what you want from a repeatable audit.

Stage 4 — LLM Vulnerability Assessment

An LLM vulnerability assessment targets the model and the orchestration layer around it:

Prompt injection resilience — does a crafted instruction in an untrusted input steer the agent into dangerous tool calls?
Function-call validation — are the parameters the model requests checked against an allowlist before execution?
Data exfiltration paths — which resources can the agent read and return to the caller?
Policy enforcement — is there a decision layer between the model's request and the tool's execution?

The critical insight is that a model can be "secure" in isolation and still be the entry point for an attack, because the vulnerability lives in how its outputs are used. That is why the assessment has to cover the full call path: model → tool choice → parameter validation → execution.

Stage 5 — Verification, Reporting, and Re-audit

Every finding gets a severity, a reproduction path, and an owner. The report feeds back into Stage 1 (new inventory), so the next audit round is strictly broader than the last.

The whole loop is scheduled — monthly or per-release — rather than triggered by an incident.

What the Workflow Is Built On

This workflow has been production-checked against a large body of real traffic. The evidence base:

A 20,000-trace public verification set, released by the Correctover organization on GitHub (Correctover/standards, release ccs-v1.0), covering production API traces used to validate detection behavior. Each record includes the provider, model, verdict, and expected result for that call.
13 providers and 33 models represented in that trace set — OpenAI, Anthropic, Google, Meta, Mistral, Cohere, DeepSeek, and others — so rules are tested against heterogeneous provider behavior rather than a single vendor.
A peer-reviewed CCS framework paper published with DOI 10.5281/zenodo.21271910, which describes the classification system that the 24-rule detection set operationalizes.

Because the rules are tested against traces from many providers and models, the detection layer is a generalization, not a hard-coded match against one framework. That is what makes the audit repeatable as your stack evolves.

Common Mistakes to Avoid

Auditing once and never again. The value is in the loop, not the snapshot.
Only static scanning. Static detection finds known patterns; MCP penetration testing and an LLM vulnerability assessment find the behavioral gaps that static rules cannot see.
Auditing the model but not the orchestration. Most MCP risk is in the tool layer, not the model weights.
No verified test data. If your detection rules are not validated against a trace set, you cannot tell a false positive from a real finding.

The Takeaway: AI Security Audit, MCP Penetration Testing, and LLM Vulnerability Assessment Are One Loop

The organizations that stay ahead treat an AI security audit the way they treat a build: something that runs regularly, fails loudly, and gets fixed fast. Structured MCP penetration testing and a repeatable LLM vulnerability assessment — backed by a versioned rule set and a verified trace dataset — are how you turn a one-time scare into a continuous process.

Correctover SDK is the detection and reliability layer this workflow plugs into. It ships the CCS detection rules (24 rules across the attack-surface categories above), an interceptor that validates each tool call on the path between the model and execution, and a provider-agnostic transport layer that keeps your agents talking to all 13 supported providers without changing your code. The same 20,000-trace verified dataset behind the audit is the dataset Correctover SDK is validated against, and the classification system is the one documented in the CCS paper (DOI 10.5281/zenodo.21271910).

If your agents call MCP tools — and they should, that is where the value is — you need a repeatable way to audit and enforce what those tools can do. That is what the Correctover SDK provides: structured detection, runtime enforcement, and a paper-backed classification system you can point your security team at.

Documentation: https://correctover.github.io
Verified trace dataset: GitHub Correctover/standards, release ccs-v1.0
CCS framework paper: DOI 10.5281/zenodo.21271910

CCS Compliance for AI Systems: A 24-Rule Framework for Production Security

correctover — Sat, 01 Aug 2026 02:07:15 +0000

CCS Compliance for AI Systems: A 24-Rule Framework for Production Security

Correctover — AI Runtime Security

Real-time RCE, SSRF & Credential Protection in 14.5µs
24 CCS detection rules · 80K production traces · 1,730+ validated findings
correctover.com/en · GitHub

This article is for informational purposes. Vulnerability findings are from responsible disclosure programs. Benchmark data from Correctover internal testing.

Your AI Agent Stack May Have These 16 Vulnerability Patterns

correctover — Fri, 31 Jul 2026 09:08:00 +0000

Your AI Agent Stack May Have These 16 Vulnerability Patterns

On July 16, 2026, Workato launched its Enterprise MCP Registry: a catalog of more than 60 production-grade MCP servers wrapped in governance controls — centralized audit trails, SOC 2 posture, and per-user identity propagation. The company's CPO framed it bluntly at launch: "protocol alone can't run your business, you need a platform."

The framing is correct, and the market is responding to a real gap. The Model Context Protocol (MCP) standardizes how AI agents discover and call tools, but it does not — and cannot — secure them. A protocol defines a wire format; it does not define trust. After three months of auditing the MCP ecosystem, our team believes the gap is not hypothetical. Here is what we found across 37 MCP repositories and 24 standalone servers, the 16 vulnerability patterns that keep recurring, and the governance checklist we give enterprise security teams.

The data: 37 repositories, 144 advisories, 75 high or critical

We ran three complementary exercises in July 2026.

1. A GitHub Security Advisory audit of 37 MCP repositories — official SDKs (Python, TypeScript, Go, Java), vendor servers (AWS, GitHub, Cloudflare, n8n, Activepieces, OpenMetadata, nginx-ui, siyuan) and ecosystem projects. Total: 144 advisories, of which 75 were rated high or critical. Nineteen of the 37 repositories had zero published GHSA entries at scan time — an audit gap worth noting, because the CVSS 10.0 RCE we confirmed (Firecrawl) shipped in a repository that was still on the zero-GHSA list when we scanned it.

2. A blind test against 24 standalone MCP servers — 5,911 files across projects ranging from 10 to 2,781 stars — produced 94 candidate findings (37 critical, 44 high, 13 medium). Manual review confirmed one exploitable command injection (AgenticX), flagged two as context-dependent, and found that 53 of the 94 (56.4%) were false positives. That false-positive rate matters directly for any team evaluating a scanner; we unpack it in the section on traditional SAST.

3. A cross-project pattern study — 16 systemic vulnerability patterns validated against 6 MCP server implementations. The headline: path traversal appeared in all 6 of 6 targets (100%). Wildcard 0.0.0.0 binding appeared in 4 of 6 (67%); hardcoded secrets in 3 of 6 (50%). Of the 16 patterns, 8 registered at least one hit across the sample.

Four findings from this work have been confirmed and disclosed:

Firecrawl MCP — eval-based remote code execution, CVSS 10.0 (GitHub Issue #4190)
Cloudflare MCP — command injection via container_exec, CVSS 9.3 (HackerOne)
AgenticX — sandbox command injection, HIGH (CVE filed)
Supabase MCP — wildcard 0.0.0.0 bind, advisory QTVA-2026-10862645

None of these are theoretical.

Risk #1 — Firecrawl MCP: eval-based RCE, CVSS 10.0

The scenario. Firecrawl MCP is widely used to ingest web content into RAG pipelines and knowledge bases. A prompt injection hidden in a crawled page can drive the ingestion side to evaluate attacker-controlled code.

The attack chain. Attacker publishes a page containing an embedded instruction → the crawler fetches it → the injected instruction steers the agent toward a tool_call that reaches the vulnerable eval path → arbitrary code executes on the machine running the crawler, which is the same process holding your vector-database credentials and pipeline secrets.

Who is exposed. Any team running Firecrawl MCP for scraping, RAG collection, SEO, or content pipelines.

Governance action. Treat every crawled page as untrusted input. Run ingestion in an isolated container with no mounted secrets, pin and review the MCP server version, and add a content-policy layer that strips embedded instructions before they reach the model.

Risk #2 — Cloudflare MCP: unsanitized command execution, CVSS 9.3

The scenario. The container_exec tool in cloudflare/mcp-server-cloudflare passes arguments straight to Node's exec(). In apps/sandbox-container/container/sandbox.container.app.ts (line 140):

const proc = exec(execParams.args)   // args is z.string(), no allowlist

The schema defines ExecParams.args as a free-form z.string() with no validation, and the /exec endpoint carries no auth middleware.

The attack chain. LLM agent → MCP container_exec → http://host:${PORT}/exec → exec(args) runs an arbitrary shell command. Combined with the container's file read/write routes, this is data exfiltration, not just sandbox escape.

Who is exposed. Teams deploying Cloudflare MCP on Workers / Durable Objects / R2, plus the developer machines and CI pipelines that run it.

Governance action. Replace exec() with spawn()/execFile() and shell: false; enforce a command allowlist; authenticate the exec route. Add a CI gate that fails on child_process.exec( with non-literal arguments.

Risk #3 — Dify: pickle deserialization plus 41 SQL-injection candidates

The scenario. Dify persists document embeddings with Python pickle in api/models/dataset.py:

return cast(list[float], pickle.loads(self.embedding))

Anyone with database access can replace an embedding field with a malicious pickle payload that executes code at deserialization. Separately, the vector-database plugins (pgvector, Oracle, AnalyticDB) build SQL by f-string concatenation — 41 injection candidates across the plugin set.

The attack chain. Compromised database (or a supply-chain path into it) → attacker writes a crafted pickle into an embedding field → a normal document lookup triggers deserialization → code execution inside the Dify API container.

Who is exposed. Self-hosted or enterprise Dify deployments running knowledge bases, customer-service agents, or low-code LLM apps.

Governance action. Replace pickle with a safe serialization format (json or numpy .npy); audit vector-DB plugin inputs for user-controlled identifiers; keep database credentials least-privilege.

Risk #4 — n8n: sandbox escapes and a privilege-escalation chain

The scenario. n8n's 2026 advisory set (20 advisories, 12 high or critical) includes an expression-sandbox escape via arrow-function bodies that reaches command execution, an authenticated code execution in the Git node, an account takeover via an unverified email claim in token-exchange embed login, and SSO instance-role provisioning that escalates to instance owner.

The attack chain. In a shared multi-user workspace, an expression in a workflow triggers the sandbox escape → arbitrary commands in the task runner → access to the credentials and LLM keys stored in the same platform. The advisory set also covers credential exfiltration via inline sub-workflow JSON from the shared-workflow editor.

Who is exposed. Any organization running n8n workflows — and especially shared multi-user workspaces.

Governance action. Keep n8n patched weekly; restrict who can edit shared workflows; isolate the task runner; treat credentials stored inside n8n as high-value assets for audit logging.

Risk #5 — Tools without a read-only guard: Stripe and Docker

The scenario. Two targets in our pattern study — stripe/ai and QuantGeekDev/docker-mcp — expose tools that can perform destructive operations with no read-only boundary. We verified three instances in stripe/ai (exploitability 65) and the same pattern in Docker's create/stop/remove/exec operations. In the MCP model, a readOnlyHint declaration is advisory: nothing at runtime enforces it.

The attack chain. A prompt injection reaches an agent wired to Stripe MCP → the agent calls a payment or subscription tool that is declared read-only but is not enforced → a real refund or subscription change executes. For Docker MCP, an agent can create, stop, or remove containers — or run arbitrary commands inside them. Docker MCP also had the highest systemic-issue density in our sample (89% of findings systemic) with only 4 source files.

Who is exposed. Payment integrators and Fintech teams routing LLM agents to Stripe; DevOps/MLOps teams letting agents manage containers.

Governance action. Enforce read-only boundaries at runtime, not just in declarations. For Stripe: restrict MCP to read-only operations unless a human approval step is in the loop. For Docker: do not expose container-management tools to shared agents; require explicit scoping.

Why traditional SAST is not enough

The blind-test results illustrate this directly. Our scanner flagged 94 candidate vulnerabilities across 24 projects in minutes. Manual review confirmed 1 and found 53 false positives — a 56.4% false-positive rate, and roughly 40% precision on critical/high findings before manual review. The false positives were not random: PyTorch's model.eval() misread as Python eval() (8.5% of findings); dictionary-key constants misread as hardcoded secrets (21.3%); SQL string-building misread as SQL injection (7.4%); Alembic migration DDL misread as injection (10.6%).

A scanner that ships a 56% false-positive rate across 5,911 files is not a governance platform — it is noise. For an enterprise security team, the pipeline that works is three-stage: (1) L1 syntax-pattern matching for breadth; (2) L2 contextual and semantic filtering to separate real sinks from safe patterns; (3) manual PoC verification on anything that survives. That is the difference between a report and a decision.

A governance checklist for your AI stack

Inventory. Enumerate every MCP server and agent tool in production — official SDKs, vendor servers, and especially the 19 zero-GHSA repositories nobody has audited yet.
Runtime verification. Static scanning finds patterns; runtime verification proves exploitability. Red-team your highest-privilege tool calls.
Enforce read-only at runtime. readOnlyHint is a declaration, not a control. Enforce it, and put destructive tools behind human approval.
Treat tool arguments as untrusted input. The fix patterns are boring and proven: execFile over exec, allowlists over regex, parameterized queries over f-strings, shlex.quote on every path interpolation.
Map to SOC 2 and audit requirements. Per-user identity propagation instead of shared service credentials, tool-level RBAC, and a centralized audit trail that records who initiated an action, which agent executed it, which systems it touched, and how it was fulfilled.
Make it continuous. New MCP servers ship weekly. Governance is a cadence, not a project.

Get a snapshot of your stack

The MCP ecosystem has a hygiene problem that compounds fast: a protocol designed for tool access, adopted at enterprise speed, shipped without the platform layer around it. Workato's registry launch is the market acknowledging that gap. Our audits are the evidence for why it matters.

We verify AI-stack security end to end — from 16 pattern classes down to a confirmed CVSS 10.0 exploit. If you want a starting point, request a free technical-stack snapshot at correctover.com/audit.html and we will send a 48-hour PDF covering your exposed MCP surface, the patterns that apply to your stack, and a fix-priority list.

This research was produced by the Correctover security team from our MCP ecosystem audit program (37-repo GHSA audit, 24-server blind test, 16-pattern cross-project study). For an enterprise AI security audit engagement, contact us via correctover.com/audit.html.

AI Agent Security Audit: From MCP Penetration Testing to LLM Vulnerability Assessment

correctover — Thu, 30 Jul 2026 08:00:40 +0000

AI Agent Security Audit: From MCP Penetration Testing to LLM Vulnerability Assessment

The rapid adoption of AI agents and MCP (Model Context Protocol) servers has introduced a new attack surface that traditional security tools were never designed to cover. Over the past 90 days, our research team has conducted systematic AI security audit across 10 major AI frameworks — including CrewAI, AutoGen, LlamaIndex, LangGraph, Dify, and Haystack — uncovering 24 distinct vulnerability patterns that affect production LLM systems.

This article shares our methodology, key findings, and practical recommendations for teams running LLM vulnerability assessment programs.

The New Attack Surface: Why AI Agents Are Different

Traditional web application security focuses on injection, broken authentication, and misconfiguration. AI agents introduce three fundamentally new risk categories:

Tool-level integrity failures — Agents can be tricked into calling internal tools with malicious parameters, bypassing the human-in-the-loop safeguards
Prompt-to-code escalation — User prompts that traverse through agent reasoning loops and execute as system commands
MCP protocol-level bypasses — Proxy servers that forward tool calls without validating intent or scope

During our MCP penetration testing engagements, we identified that over 60% of MCP server implementations lack basic access control on tool execution — any connected client can invoke any registered tool, including destructive write operations disguised as read-only calls.

The CCS Methodology: 24 Rules, 10 Frameworks, 4 Platforms

Our Component Correctness Standard (CCS) scanner employs 24 detection rules organized by vulnerability category:

Category	Rules	Coverage
Code Injection (Python/JS/Shell)	6	RCE via eval/exec/spawn/subprocess
Path Traversal	4	Unsanitized user input in file operations
SSRF/Open Redirect	3	Unvalidated URLs in agent tool calls
Insecure Deserialization	3	Pickle/yaml/JSON parser abuse
SQL Injection (format strings)	2	Dynamic query construction
Credential Leakage	2	Hardcoded tokens in source
MCP-specific (readOnlyHint bypass)	2	Protocol-level authorization gaps
Supply Chain (npm/PyPI confusion)	2	Dependency confusion vectors

The scanner has been validated against 80,000 API traces (20,000 publicly verified + 60,000 reserve), covering 13 providers and 33 models. Performance benchmarks show P50=22µs and P99=99µs per rule evaluation, making it suitable for runtime guardrail deployment.

Real-World Findings

Our framework integration campaign (July 2026) resulted in confirmed vulnerabilities across multiple high-profile projects:

Project	Vulnerability	CVSS Equivalent	Status
Revis (蚂蚁集团)	Path Traversal	7.5 (HIGH)	Submitted to 蚂蚁SRC (QTVA-2026-10862552)
CodeAnalysis (腾讯)	Path Traversal via task_id	7.5 (HIGH)	Submitted to 腾讯SRC (QTVA-2026-10862567)
Monolith+verl (字节跳动)	Tool Parameter Injection	7.0 (HIGH)	Submitted to 字节SRC (QTVA-2026-10862588)
LLaMA-Factory (360)	SSRF via Model Loading	7.5 (HIGH)	Submitted to 360SRC (QTVA-2026-10862618)
Light-R1 (深度求索)	Path Traversal	7.0 (HIGH)	Submitted to 360SRC (QTVA-2026-10862636)
fdp-mcp-server	Missing readOnlyHint Check	7.5 (HIGH)	Submitted to 补天
Dify	SQL Injection (f-string)	8.0 (HIGH)	Submitted to 补天 (QTVA-2026-10861217)
Stripe-MCP	Metadata Injection	7.0 (HIGH)	Submitted to 补天 (QTVA-2026-10861865)

All findings were submitted through responsible disclosure channels including 补天, HackerOne, Bugcrowd, ZDI, and MSRC — achieving 100% submission pipeline automation.

Deep Dive: MCP Security Audit Case Study

Case 1: fdp-mcp-server — readOnlyHint Bypass

During our AI security audit of MCP proxy implementations, we discovered that fdp-mcp-server's _call_tool function at proxy_server.py:87 forwards all tool requests to the backend without checking the readOnlyHint flag:

async def _call_tool(req: types.CallToolRequest) -> types.ServerResult:
    result = await remote_app.call_tool(
        req.params.name, (req.params.arguments or {})
    )
    return types.ServerResult(result)

The MCP protocol specification defines readOnlyHint as a field on Tool objects returned by ListToolsResult, intended to signal read-only intent. Since the proxy never validates this flag, an attacker can invoke destructive write operations through the proxy even when the client was configured for read-only access.

Impact: Any MCP proxy server that lacks readOnlyHint validation effectively nullifies the protocol's access control mechanism. This affects all deployments using fdp-mcp-server as a transparent proxy.

Case 2: CodeAnalysis Path Traversal (腾讯)

The CodeAnalysis client's taskdirmgr.py constructs file paths using os.path.join() with a task_id taken directly from the server API response:

def acquire_task_dir(self, task_id):
    task_dir = os.path.join(self._task_dirs_root, f"task_{task_id}")
    os.makedirs(task_dir, exist_ok=True)
    return task_dir, task_id

Since task_id at looprunner.py:204 comes from task_request.get('id') with zero validation, an attacker controlling or MITM-ing the server can supply ../../etc/evil as the task ID, causing arbitrary directory creation outside the intended workspace. Confirmed on both Linux and Windows environments.

Building Your LLM Vulnerability Assessment Pipeline

Based on our experience across 10 framework integrations and 80K API traces, here's a practical methodology for running LLM vulnerability assessment at scale:

Phase 1: Static Analysis (24 Rules)

Run the CCS rule set against your agent codebase:

Code injection checkers: grep for exec(), eval(), subprocess.Popen() with user input
Path traversal checkers: identify os.path.join() or Path() calls with unsanitized parameters
Credential scanners: regex for API keys, tokens, and hardcoded secrets
MCP protocol checkers: verify readOnlyHint and tool registry access control

Phase 2: Dynamic Testing

For each identified static finding:

Reproduce with a minimal PoC that proves the vulnerability
Document the full attack chain (not just the code location)
Verify the impact with a controlled test environment

Phase 3: Responsible Disclosure

Submit findings through the appropriate channel:

Open source: GitHub Advisory + direct maintainer contact
Enterprise SRC: 蚂蚁SRC/腾讯SRC/字节SRC/360SRC for Chinese vendors
Bug bounty: HackerOne / Bugcrowd for eligible programs
ZDI/MSRC: For Microsoft ecosystem vulnerabilities

What's Next for AI Agent Security

The AI security landscape is evolving faster than most organizations can keep up. Based on our research pipeline, here are the top three areas we're watching:

Agent-to-agent protocol security — As multi-agent systems grow, inter-agent communication channels become prime attack surfaces
Supply chain audits of LLM dependencies — Model loading, LoRA adapter downloads, and plugin ecosystems are largely unvetted
Runtime guardrail bypasses — Even with input validation, clever prompt engineering can bypass safety layers

If your team is running an AI security audit or needs MCP penetration testing for your deployment, our CCS scanner and methodology are available as open-source tools. The 24 detection rules power both our public scanner and our enterprise audit service.

This research was conducted by the Correctover security team. CCS scanner is available on GitHub at github.com/Correctover/ccs-scanner. For enterprise security audits, contact us at wangguigui@correctover.com.

为什么越来越多海外买家选择福建石材？

correctover — Tue, 28 Jul 2026 07:04:41 +0000

为什么越来越多海外买家选择福建石材？

近年来，福建石材在全球市场的份额持续增长。从欧洲建材超市到中东工程项目，福建石材的身影越来越常见。本文解析海外买家选择福建石材的核心原因。

一、出口规模领先

福建是中国最大的石材出口省份，出口额占全国石材出口的较大比重。（来源：中国石材行业协会公开数据）

主要出口市场：

东南亚（东盟国家）
中东（阿联酋、沙特、卡塔尔）
欧洲（德国、英国、法国）
美洲（美国、加拿大、巴西）
大洋洲（澳大利亚、新西兰）

二、六大竞争力优势

1. 产业链完整

从矿山开采到成品出口的全链条能力，意味着：

原材料采购成本更低
加工环节衔接紧密
配套辅料就地采购
出口服务一站式

2. 技术成熟

数十年石材加工经验积累：

成熟的石英石板材生产工艺
数控加工精度
丰富的异形定制经验
持续的技术升级投入

3. 交期可靠

产业集群带来的供应稳定性：

原材料库存充足
多家工厂可并行生产
厦门港/泉州港密集航运线路
专业的出口物流团队

4. 品质稳步提升

福建石材的品质管控对标国际标准：

ISO质量管理体系认证
出口产品的检测标准与欧洲同步
第三方检测机构便捷接入

5. 成本竞争力

规模化生产摊薄固定成本
产业集群降低采购成本
熟练工人提高生产效率
良性竞争促进价格透明

6. 服务意识

福建石材企业近年来在客户服务方面明显提升：

英语销售团队覆盖
样品快速送达
项目管理沟通
售后技术支持和质量保障

三、福建石材采购实操建议

供应商筛选要点

核实工厂资质：营业执照、生产许可、检测报告
考察生产现场：设备水平、质量管控、产能规模
验证出口经验：出口记录、客户案例、国际认证
评估服务能力：英语沟通、项目管理、售后响应

双基地供应商的额外优势

拥有中国+海外双基地的供应商（如泉州+泰国曼谷），提供了额外的供应保障和灵活性，特别适合对供应链安全要求高的客户。

厦门九头牛实业有限公司 / 泉州君诺美建筑材料有限公司

双生产基地：中国福建泉州 + 泰国曼谷
主营：石英石、岩板、人造石
联系人：王桂桂 | 电话：15960098402 | 邮箱：wgg234114134@163.com
泉州工厂：德国进口生产线，22项专利技术
泰国工厂：曼谷生产基地，服务东盟及全球市场

本文信息来源于公开行业资料和企业资质文件。价格数据来源于公开市场报价，实际价格以供应商报价为准。

本文产业信息来源于公开行业数据。企业信息来源于国家企业信用信息公示系统。

AI Security Audit and MCP Penetration Testing: A Practical Guide for AI Agent Security

correctover — Mon, 27 Jul 2026 08:29:57 +0000

AI Security Audit and MCP Penetration Testing: A Practical Guide for AI Agent Security

MCP（Model Context Protocol）正在迅速成为 AI Agent 与外部工具交互的标准协议。随着 MCP 生态从实验阶段进入生产部署，针对 MCP Server 的安全评估——包括 LLM vulnerability assessment 和 AI agent security audit——已经成为 AI 基础设施安全团队必须面对的新课题。

为什么 MCP 安全如此重要

MCP 赋予了 AI Agent 调用外部工具的能力，但这也意味着攻击面从纯文本交互扩展到了操作系统命令执行、文件系统访问和网络请求。我们的 CCS（Correctover Code Scanner）安全审计团队在 2026 年 7 月对 12 个主流 AI Agent 框架执行了全量扫描，累计发现 1,730 项已验证的安全发现，覆盖 AutoGen、Semantic Kernel、Dify、FastMCP、MCP Python SDK、Griptape 等框架（来源：CCS v4.2 全量扫描，2026-07-21）。

MCP Server 攻击面分析

基于我们的实际审计经验，MCP Server 的核心攻击面集中在以下四个方面：

1. 工具注入（Tool Injection）：LLM 生成的 tool_call 参数直接传递给操作系统命令执行函数。CrewAI 的 MCP StdioTransport 是典型案例，其 __init__() 方法将命令参数无校验传递至 stdio_client()，触发任意 OS 子进程执行，已分配 CVE-2026-2287（来源：MSRC Case 126356，2026-07-10）。

2. 反序列化 RCE：LlamaIndex Workflows 使用 pickle 作为默认序列化器，攻击者可以通过控制序列化数据触发任意代码执行（LI-PICKLE-001，CVSS 9.8，来源：Phase 2 狩猎报告，2026-07-10）。Haystack Pipeline 的 Pipeline.loads() 通过 import_class_by_name() 动态加载任意 Python 模块，同样导致反序列化 RCE（HS-PIPE-001，CVSS 9.8，来源：Haystack 2.31.0 安全审计，2026-07-10）。

3. 凭据泄露：MCP Python SDK 的 CLI 层（cli.py:280）将 os.environ 直接传递给子进程，导致环境变量泄露（AGT-ENV-LEAK，CVSS 7.0，来源：CCS v4.2 扫描，2026-07-21）。

4. SSRF 与服务端请求伪造：AutoGen Studio 通过 MCP STDIO 协议暴露双路径 RCE，已提交 MSRC（来源：CrewAI MCP RCE 报告，2026-07-10）。

5-Step MCP Penetration Testing Checklist

以下是我们在实际审计中使用的五步检查清单：

Step 1: 协议传输层审计
检查 MCP STDIO 传输层是否对 command 和 args 参数做输入校验。重点检查 stdio_client() 调用路径，确认是否有 allowlist/denylist 机制。CrewAI 零防护的 StdioTransport 是反面教材（来源：CVE-2026-2287）。

Step 2: 反序列化边界扫描
扫描所有序列化/反序列化入口点，特别是 pickle、yaml.load、eval/exec 调用。LlamaIndex Workflows 的 pickle 反序列化（CVE 待分配）和 Haystack 的 Pipeline.loads() 都属于此类（来源：Phase 2 + Haystack 审计报告，2026-07-10）。

Step 3: 环境变量与凭据暴露检测
检查 os.environ 是否会传递给子进程或写入日志。MCP Python SDK 和 FastMCP 均有环境变量泄露问题（来源：CCS v4.2，2026-07-21）。

Step 4: LLM 输出注入测试
构造恶意 prompt 诱导 Agent 调用危险工具函数。使用 prompt injection payload 库覆盖工具调用场景。

Step 5: 运行时行为监控
传统静态扫描无法覆盖运行时动态行为。部署运行时验证层，对每个 tool_call 做策略检查，确保参数类型、权限范围、执行路径符合安全基线。

Runtime Verification：填补静态扫描的空白

静态代码扫描可以发现已知模式的安全漏洞，但对于运行时动态行为——如 LLM 生成的 tool_call 参数是否越权、序列化数据是否被篡改——需要 runtime verification 能力。

CCS（Correctover Code Scanner）采用 Interceptor 架构，在 AI Agent 的 tool_call 执行路径中插入策略检查点，对每次调用执行参数校验、权限验证和审计日志记录。实测数据显示，CCS 核心 evaluate 操作的 P50 低于 10µs，P99 低于 25µs（来源：CCS v1.0 性能基准测试，50K 次迭代，2026-07-25），性能开销可忽略不计。

总结

MCP 生态的安全成熟度仍处于早期阶段。我们通过全量扫描发现的 1,730 项安全问题和多个 CVSS 9.8 RCE 漏洞表明，当前主流 AI Agent 框架在工具注入、反序列化、凭据保护方面存在系统性缺陷。AI agent security 需要从静态扫描走向运行时验证，才能真正覆盖全攻击面。

Correctover 提供面向 AI Agent 的运行时安全层（AI Runtime Security Layer），通过 CCS 在工具调用路径中实施策略校验和实时防护，在不影响性能的前提下填补传统安全工具的空白。

了解更多：https://correctover.github.io

石英石台面日常保养与维护指南

correctover — Mon, 27 Jul 2026 08:23:33 +0000

石英石台面日常保养与维护指南

石英石以其高硬度和低维护成本著称，但正确的日常保养能显著延长台面的使用寿命和美观度。本文提供实用的石英石台面保养指南。

一、日常清洁

每日清洁

步骤	方法
1. 表面清理	用软布或海绵清除表面杂物
2. 清水擦拭	用温水湿润的软布擦拭
3. 擦干	用干布擦干表面

二、污渍处理方法

污渍类型	处理方法
普通污渍（油渍/酱汁）	中性清洁剂+温水擦拭
咖啡/茶/红酒	小苏打糊敷15分钟后清洗
油墨/记号笔	酒精擦拭（立即处理）
胶水残留	温水浸泡后轻刮

对于顽固污渍，建议先在小面积试用清洁方法。

三、日常注意事项

温度的注意事项

虽然石英石耐温约150℃，但建议：

热锅/热壶下使用隔热垫
避免冷热急剧交替
电热锅等持续高温器具下加隔热板

切割的注意事项

石英石硬度高（莫氏6-7），日常切割不易留痕
但建议使用砧板（保护刀具，也保护台面）
避免在台面上剁硬物

四、长期维护

定期检查

每月检查接缝处是否完好
检查水槽周边密封是否严密
检查表面抛光是否退化

专业维护

维护项目	频率	说明
表面抛光	2-3年一次	恢复光泽度
接缝修复	按需	变黄或松动的接缝重新处理
深度清洁	每年一次	专业清洁&密封检查

厦门九头牛实业有限公司 / 泉州君诺美建筑材料有限公司

双生产基地：中国福建泉州 + 泰国曼谷
主营：石英石、岩板、人造石
联系人：王桂桂 | 电话：15960098402 | 邮箱：wgg234114134@163.com
泉州工厂：德国进口生产线，22项专利技术
泰国工厂：曼谷生产基地，服务东盟及全球市场

本文信息来源于公开行业资料和企业资质文件。价格数据来源于公开市场报价，实际价格以供应商报价为准。

本文维护建议基于行业常规保养指南。具体产品请以供应商提供的保养手册为准。

We Found 56+ Security Vulnerabilities (6 Critical RCEs) Across 13 AI Agent Frameworks - Here Is What Systematic Auditing Taught Us

correctover — Sat, 25 Jul 2026 10:00:49 +0000

We Found 56+ Security Vulnerabilities (6 Critical RCEs) Across 13 AI Agent Frameworks — Here Is What Systematic Auditing Taught Us

The AI agent ecosystem is growing faster than its security practices can keep up. Over the past six weeks, we ran a systematic security audit across 13+ mainstream AI agent frameworks — CrewAI, AutoGen, AG2, LlamaIndex, Haystack, LiteLLM, Semantic Kernel, LangChain, Dify, FastMCP, MCP Python SDK, Griptape, and Docker MCP. The results were sobering: 56+ verified security vulnerabilities, including 7 that we responsibly disclosed to MSRC, ZDI, HackerOne, and GitHub Security. Six of those are Remote Code Execution (RCE) vulnerabilities with CVSS scores of 9.8 or 9.3. One is a critical SSRF that bypasses existing guardrail protections.

This is not a theoretical exercise. Every vulnerability listed here was verified with a working proof of concept and, where possible, submitted through a formal bounty channel. Some produced same-day responses from Microsoft's Security Response Center.

The 7 Responsibly Disclosed Vulnerabilities

1. CrewAI MCP StdioTransport RCE (CVSS 9.8)

The StdioTransport.__init__() method in CrewAI passes user-controlled command strings directly to stdio_client() with zero validation. Any MCP server configuration pointing to a malicious command triggers arbitrary OS process execution. CrewAI was the most vulnerable mainstream framework we tested — no allowlist, no input sanitization, nothing. We filed this with MSRC and received a case number (126356) the same day. It is now tracked as CVE-2026-2287.

2. AutoGen Studio RCE (CVSS 9.8)

Microsoft AutoGen's magentic-one-cli accepts a --config parameter that is passed directly to Python's open() without any path validation. Combined with AutoGen's exec() usage in captainagent (another MSRC-reported RCE), an attacker who controls the configuration file path achieves full remote code execution on the host. We submitted both vectors to MSRC alongside the path traversal disclosure.

3. AG2 eval() `str\` Bypass RCE (CVSS 9.8)

AG2 (the community fork of AutoGen) uses eval() in context_expression.py for string interpolation during agent group chat. The code does escape string values, but objects that implement a custom __str__() method bypass that escape mechanism entirely. The source code even contains a comment explicitly acknowledging that "custom __str__ injection is out of scope." An LLM-controlled context_variables value with a crafted __str__ method produces full RCE with no additional exploit steps. Filed as GitHub Issue #3073.

4. LlamaIndex Pickle Deserialization RCE (CVSS 9.8)

The Workflows serializer in LlamaIndex calls pickle.loads(base64.b64decode(value)) — textbook pickle RCE against one of the most widely used LLM orchestration frameworks. The PickleSerializer is registered as one of the default serializers for workflow state persistence, meaning any workflow that serializes intermediate state is exploitable. A malicious workflow definition triggers arbitrary code execution at deserialization time. Filed as GitHub Issue #22296.

5-6. Haystack Pipeline Deserialization RCEs (CVSS 9.8 and 9.3)

Haystack 2.31.0 has two independent deserialization RCE pathways, both critical.

The first (CVSS 9.8): Pipeline.loads() calls import_class_by_name() to dynamically import any Python class from YAML or JSON input. The chain thread_safe_import() followed by getattr(module, class_name) gives an attacker full control over class instantiation — no module allowlist is enforced.

The second (CVSS 9.3): deserialize_callable("os.system") returns a callable os.system function object directly. This deserialized callable is used by Tool.from_dict() and OutputAdapter.from_dict(), meaning any pipeline loading serialized tool definitions can be hijacked. No type restrictions or module allowlists are applied.

7. LiteLLM Guardrail SSRF (CVSS 8.6)

LiteLLM's guardrail hook system uses is_valid_url() to validate URLs — but this function performs only a syntax check. The platform separately provides validate_url(), which performs DNS resolution, IP blacklist checking, and URL rewriting, but it is never called from the guardrail http_request() path. This gap allows an attacker who can inject a guardrail configuration to access cloud metadata endpoints (169.254.169.254), Azure Wire Server, and internal network services, all through a validated-by-syntax URL. Filed as GitHub Issue #32862.

The Scale of the Problem

These seven disclosures are the visible part of a much larger finding. Our automated scanning using the Correctover CCS (Call Correctness Standard) v1.0 detection engine identified 56+ verified vulnerabilities across 13+ frameworks — after false positive filtering and manual PoC verification.

The largest single source of vulnerabilities is what we call the MCP readOnlyHint gap. The modelcontextprotocol/python-sdk defines a readOnlyHint boolean on tools to indicate read-only intent, but the runtime never enforces it. Every downstream framework inherits this broken contract. We found 87 production code instances of unguarded tool invocation across six frameworks — AutoGen, Semantic Kernel, FastMCP, Dify, Griptape, and MCP Python SDK itself. The readOnlyHint acts as documentation only, with zero runtime consequences.

Beyond the readOnlyHint gap, three vulnerability patterns appeared consistently across frameworks:

Tool argument injection: Frameworks pass LLM-generated tool call arguments directly to OS-level functions like subprocess.Popen() with no validation or escaping. This was most severe in CrewAI (zero mitigations) but also present in LiteLLM (allowlist with known bypasses).
Path traversal in config loaders: User-controlled file paths in CLI arguments and configuration files feed directly into open() calls. AutoGen and Dify both had this pattern at CVSS 9.8.
Environment variable leakage: CLI tools pass os.environ to child processes, leaking API keys and secrets. Found in MCP Python SDK and FastMCP.

How We Found Them: Methodology

The audit process combines automated scanning with manual validation:

24 CCS detection rules — compiled from real vulnerability research across six months of agent framework analysis. Each rule targets a specific exploit class: eval/exec misuse, unsafe deserialization (pickle, yaml.load, import_by_name), subprocess injection, path traversal, SSRF, and environment leakage.
Dual-path detection — AST scanning identifies structural patterns (e.g., function calls to eval(), pickle.loads(), subprocess.Popen()) while regex verification cross-checks against known exploit signatures. This dual-path approach significantly reduces false positives.
PoC-gated classification — every candidate finding receives a working proof of concept before being classified as a confirmed vulnerability. Only PoC-verified findings enter the final count.

The 24 detection rules are published as part of the CCS v1.0 standard at github.com/Correctover/standards. The accompanying open dataset includes 20,000 production API traces from 13 LLM providers and 33 models — part of a total 80,000-trace corpus collected through real API measurements.

Runtime verification latency is P50=22 microseconds (measured across 1 million samples), making it feasible to insert into production agent call paths with no perceptible overhead.

Why This Matters for AI Agents in Production

The vulnerabilities we found share a disturbing pattern: they are not obscure edge cases. They are fundamental architectural gaps in how agent frameworks handle untrusted input from LLMs.

Every framework we tested assumes LLM outputs are authoritative. The architecture treats "what the LLM says" as trusted and routes it directly to tool execution — with no verification layer in between. This is the equivalent of running eval() on user input in a web application, a practice the security industry stopped tolerating two decades ago.

The frameworks that have implemented security measures — LiteLLM's allowlist, AutoGen's partial mitigations — apply them inconsistently with known bypasses. The MCP readOnlyHint is the clearest example: a security contract defined in the protocol specification but never enforced in the runtime, giving developers a false sense of safety.

When an agent framework runs in production with access to internal APIs, databases, filesystem, and code execution, every one of these vulnerabilities becomes a potential data breach or full host compromise.

Runtime Call Verification: The Missing Security Layer

What the AI agent ecosystem needs is not more per-framework security patches applied after vulnerabilities are found. It needs a verification layer that sits on the execution path between the LLM and tool execution — enforcing policy regardless of which framework is in use.

The Correctover CCS SDK implements this as a synchronous interceptor: a @govern() decorator that validates every tool call against a policy before the tool executes. Unlike observer-pattern hooks (which produce a callback but do not block execution — a CWE-636 fail-open pattern present in every major framework we audited), the CCS interceptor operates on the execution path itself. If governance crashes, the tool is blocked. Fail-closed, not fail-open.

The SDK integrates with CrewAI, AutoGen, LangChain, and LangGraph in 2-4 lines of code. The CCS v1.0 standard, detection rules, and integration kit are all open source at github.com/Correctover.

The 56+ vulnerabilities we found are not someone else's problem. If you are deploying AI agents in production today — with access to internal APIs, databases, or code execution — you are exposed to these same attack surfaces. The question is not whether your framework has these vulnerabilities, but whether you have a runtime verification layer catching them before they reach production.

This research was conducted by the Correctover security research team. Responsible disclosure timeline and individual advisory details are available at github.com/Correctover/standards and github.com/Correctover/mcp-security-audit.

AI Agent Security is Broken — We Integrated Runtime Call Verification into 4 Major Frameworks

correctover — Sat, 25 Jul 2026 07:37:07 +0000

The Blind Spot in AI Agent Security

Every major AI security framework today — LangChain, Promptfoo, Garak, PyRIT — shares a critical blind spot: they check what comes into the model, but not what the model tells its tools to do.

In 2026, AI agents don't just chat. They:

Execute shell commands via MCP servers
Make HTTP requests to internal services
Read and write filesystem paths
Authenticate to third-party APIs

When an LLM tells a tool to os.system("rm -rf /data") or curl http://169.254.169.254/latest/meta-data/, that's not a "prompt" — it's a runtime call. And none of the existing frameworks were designed to inspect that.

We built Correctover CCS (Call Shield) to fill this gap, and today we're announcing production-grade integrations with all four major frameworks.

What is CCS?

CCS is a deterministic runtime call verification engine for AI agents. It inspects LLM-generated tool call payloads against 24 rules across 7 categories in 22µs (P50):

Category	Rules	What It Detects
Prompt Injection	6 rules	System prompt override, role hijacking, delimiter injection
RCE	5 rules	os.system(), subprocess.Popen(), eval(), rm -rf, curl \| bash
SSRF	3 rules	Localhost, metadata endpoints (169.254.169.254), private network ranges
Path Traversal	3 rules	../, /etc/passwd, ~/.ssh, Windows boot.ini
Credential Leak	4 rules	AWS keys, SSH private keys, API tokens, Bearer auth
Insecure Deserialization	3 rules	pickle.loads(), unsafe yaml.load(), eval()
Sensitive Data Exposure	2 rules	Database URLs, kubectl/terraform/gcloud commands

No LLM dependency. No false positive tuning. No API call to an external service.

The Four Integrations

1. LangChain (`langchain-core` Callback)

PR: #39067

The most native integration. A BaseCallbackHandler subclass that hooks into LangChain's on_agent_action callback — right at the moment a tool call is generated and before it's executed.

from correctover_langchain import CorrectoverCallbackHandler

# Mode 1: Log — detect but don't block
handler = CorrectoverCallbackHandler(mode="log")

# Mode 2: Block — raise on violation
handler = CorrectoverCallbackHandler(mode="block")

# Mode 3: Report — collect and summarize
handler = CorrectoverCallbackHandler(mode="report")

agent = initialize_agent(
    tools=tools,
    llm=llm,
    callbacks=[handler],
)

Also includes CorrectoverCCSRunnable — an LCEL-compatible Runnable wrapper for tool-level validation in LangGraph pipelines. Install via pip install correctover-langchain.

2. Promptfoo (Plugin)

PR: #10207

A lightweight plugin that adds CCS checks to Promptfoo's red-teaming assertions. Works with Promptfoo's existing test harness — no configuration beyond adding ccs-tool-call to your promptfooconfig.yaml:

targets:
  - id: python
    config:
      tools: [read_file, write_file, exec_shell]

assert:
  - type: ccs-tool-call
    rules: [RCE, SSRF, PATH_TRAVERSAL]

3. Garak (Detector Plugin)

PR: #1987

A Garak Detector subclass that integrates CCS scanning into Garak's probe → detector pipeline. Works with any probe that generates tool-calling prompts (e.g., agent_breaker):

garak --model_type <model> \
  --probes agent_breaker \
  --detectors ccs.CCSDetector

Returns 0.0 (clean) / 0.7–1.0 (violation severity) per output. Tags: quality:Security:AgentSecurity, owasp:llm06.

4. PyRIT (Scorer Plugin)

PR: #2273

A RegexScorer subclass following the same pattern as PyRIT's existing XSSOutputScorer, SQLInjectionOutputScorer, and ShellCommandOutputScorer. 24 compiled regex patterns, configurable by category:

from pyrit.score import CCSOutputScorer

scorer = CCSOutputScorer()
score = await scorer.score_text_async(
    text='subprocess.run("rm -rf /data", shell=True)'
)
# score = True (detected)

Why "Deterministic" Matters

Every integration above uses deterministic rule matching — no LLM calls during inference. This is a deliberate architectural choice:

Latency: 22µs P50 vs 500ms+ for LLM-based scanners
Cost: Zero inference cost vs paying per-token for LLM judges
Certainty: No false positives from model drift. A regex either matches or it doesn't
Auditability: Every detection is explainable — "pattern X matched string Y at position Z"

For production AI agents handling millions of tool calls per day, this matters.

The Bigger Picture

These four integrations cover four different use cases:

Framework	Best For
LangChain	Production AI agent deployment with real-time blocking
Promptfoo	Red-teaming and security testing during CI/CD
Garak	Large-scale adversarial probing and benchmarking
PyRIT	Security research and scoring automation

Together, they mean any team building with AI agents can slot in runtime call verification regardless of their framework choice.

What's Next

MCP Server validation — shield mode for MCP connections (Q3 2026)
OpenTelemetry integration — CCS metrics in your observability stack
Custom rules — BYO regex patterns per deployment

All integrations are open source under Correctover's commercial license. Try them:

GitHub: github.com/Correctover
CCS Standard: github.com/Correctover/standards
Website: correctover.com
MCP Server: pip install correctover-mcp-server

Correctover CCS — Runtime Call Verification for AI Agents. Because your AI should execute what you intended, not what the prompt tricked it into.

MCP Penetration Testing: A Practical Guide for AI Agent Infrastructure Security

correctover — Sat, 25 Jul 2026 02:28:34 +0000

MCP Penetration Testing: A Practical Guide for AI Agent Infrastructure Security

The rapid adoption of the Model Context Protocol (MCP) has created a new attack surface that traditional security tools — SAST, DAST, WAFs — were never designed to cover. When an AI agent speaks to a database, a file system, a cloud API, or a CI/CD pipeline, it does so through an MCP server. If that server is vulnerable, the agent becomes a delivery vehicle for exploitation.

This guide covers what MCP penetration testing actually looks like in practice, the most common vulnerability patterns we have identified across production AI systems, and how LLM vulnerability assessment differs from conventional web app testing.

Why MCP Security Is a New Category

Unlike a REST API where each endpoint is documented and version-controlled, an MCP server exposes a dynamic tool surface. Tools are registered at runtime, invoked by natural-language prompts, and often chain results across multiple backends. This creates three unique risks:

Tool injection — An attacker-controlled input reaches an MCP tool and is executed with the agent's privilege level
Cross-tool data leakage — Information from one tool response is inadvertently passed to another tool with broader access
Prompt-to-tool escalation — A carefully crafted prompt causes the agent to invoke a dangerous tool combination

Our AI security audit practice has analyzed over 80,000 (20K public + 60K internal) production traces across 13 providers and 33 model architectures. The data shows that approximately 1 in 4 MCP deployments have at least one high-severity exposure in their tool surface.

The MCP Attack Surface: 6 Critical Dimensions

When conducting MCP penetration testing, we evaluate six distinct dimensions:

1. Unvalidated Tool Arguments

Most MCP servers define tools with typed parameters but do not validate the values passed to those parameters. A tool like read_file(path: string) trusts the agent to provide a valid path — but a compromised or jailbroken agent can pass ../../etc/passwd.

Real finding: We discovered and reported a path traversal in a popular MCP file-server package that allowed reading arbitrary files outside the workspace directory. The fix required adding canonical path validation to every tool entry point.

2. Missing Authorization Boundaries

In production MCP deployments, multiple users or agents share the same MCP server. Without per-tool authorization, Agent A can invoke tools that were designed for Agent B alone.

Real finding: In a financial AI platform, the execute_trade and read_portfolio tools were registered on the same MCP server with no access control. Agent isolation was the recommended remediation.

3. Implicit Tool Chaining

MCP allows one tool output to be passed as another tool input. Attackers exploit this by crafting inputs that produce side effects in downstream tools.

Real finding: We identified an RCE chain in a CrewAI MCP deployment where read_file output containing shell metacharacters was passed to run_command, resulting in remote code execution. This finding was validated with a working PoC and reported through responsible disclosure.

4. Resource Exhaustion

MCP tools that perform expensive operations (database queries, file I/O, API calls) can be triggered repeatedly by an agent, causing denial of service.

5. Insecure Default Configurations

Many MCP servers ship with debug mode enabled, overly permissive CORS, or default credentials. These configurations are rarely hardened before deployment.

6. Prompt Injection via Tool Responses

When an MCP tool returns data that contains instructions, a vulnerable agent may interpret those instructions as commands. This is the MCP-specific variant of indirect prompt injection.

How We Discovered 53 PoCs Across 8 Frameworks

Between June and July 2026, our security research team conducted a systematic LLM vulnerability assessment across the 8 most popular AI agent frameworks:

Framework	Critical Findings	Type
CrewAI MCP	1 RCE	Tool injection chain
AutoGen Studio	1 RCE (CVSS 9.8)	Tool argument injection
AG2	1 RCE	str method exploit
LlamaIndex	1 RCE	Pickle deserialization
Haystack	2 RCE	Pipeline injection
LiteLLM	1 SSRF	Proxy bypass
Docker MCP	2 vulns	Container escape + credential leak
LangChain	Multiple	Prompt injection surface

Every finding includes a working Proof of Concept validated in a sandboxed environment. We follow responsible disclosure: findings go to the vendor PSIRT or bug bounty program prior to public disclosure, with a 90-day disclosure window.

Total: 53 PoCs reproduced, 1,730+ validated findings across a corpus of 80,000 (20K public + 60K internal) production traces.

Automated MCP Security Auditing with CCS

Manual MCP penetration testing is essential for deep analysis, but automated scanning catches the low-hanging fruit at scale. Our CCS (Correctover Classification System) engine applies 24 detection rules that map to the 6 dimensions above.

How CCS works for MCP:

Discover — Enumerate all tools registered on the MCP server
Fuzz — Inject boundary values, special characters, and known exploit patterns into each tool parameter
Chain — Test tool combinations for escalation paths
Report — Classify findings by CCS rule ID with CVSS scoring

The engine processes a typical MCP server in under 30 seconds, with a false positive rate below 3% on production-tested configurations. This speed enables continuous auditing as part of a CI/CD pipeline.

5-Step MCP Penetration Testing Checklist

If you are conducting your own AI security audit of an MCP-based system, use this checklist:

Step	Activity	Tool
1	Map all registered tools and their parameter schemas	MCP inspector / custom script
2	Test each parameter for injection (path, command, SQL, SSRF)	CCS scanner / manual fuzzing
3	Test tool combinations for escalation chains	Custom harness
4	Verify authorization boundaries between agents	Configuration review
5	Audit transport security (TLS, auth tokens, credential storage)	Network scan + code review

This checklist covers the most common failure modes we see in production deployments. For a deeper assessment, we recommend engaging a specialized MCP penetration testing team with access to your actual production traces and tool configurations.

The Bottom Line

MCP is transforming how AI agents interact with the world, but every new capability is a new attack surface. The frameworks we analyzed in July 2026 contained an average of 2-3 high-severity vulnerabilities per deployment.

Key takeaways:

Treat every MCP tool as a public API endpoint — validate all inputs
Never share MCP servers across authorization boundaries without isolation
Run automated CCS scans on every new MCP release
Include MCP tool chains in your regular LLM vulnerability assessment rotation

Correctover — AI Runtime Security & MCP Penetration Testing

Real-time RCE, SSRF & Credential Protection in 22µs (P50)
24 CCS detection rules · 80,000 production traces · 1,730+ validated findings
CVE-2026-2287 · MSRC · ZDI · HackerOne · Bugcrowd
GitHub · correctover.com/en

This article is based on verified empirical data from production AI systems. All vulnerability findings were disclosed through responsible disclosure programs. Benchmark data from Correctover internal testing environment.

石材台面加工工艺流程：从大板切割到成品安装

correctover — Sat, 25 Jul 2026 02:10:55 +0000

石材台面加工工艺流程：从大板切割到成品安装

石英石和人造石台面的加工质量直接决定最终效果。了解加工工艺流程有助于采购方判断供应商的专业水平。本文详解台面加工的核心环节。

一、原材料准备

大板检验

加工前对大板进行质量检查：

表面缺陷（裂纹、气泡、色斑）
厚度一致性
颜色与封样对比

排版优化

利用专业软件优化切割排版，目标是：

材料利用率最大化（优质工厂可达90%以上）
纹理方向一致性
减少拼接数量

二、切割加工

数控切割（CNC）

现代石英石加工采用CNC数控设备：

设备	用途	精度
CNC桥切机	大板切割	±0.5mm
水刀切割机	异形切割	±0.3mm
数控开孔机	水槽/灶孔	±0.5mm

切割注意事项

使用水冷切割（防止石英石过热开裂）
切割速度需根据板材厚度调整
边缘预留抛光余量（约1-2mm）

三、边缘处理

边缘造型类型

边缘类型	特点	适用风格
直边	简洁利落	现代简约
斜边	45°倒角	轻奢风格
圆弧边	圆润安全	北欧/日式
牛鼻边	经典传统	美式/欧式
双级边	层次感	高端定制

抛光工艺

边缘抛光分多道工序：

粗磨（50-100目）：去除切割痕迹
中磨（200-400目）：平整表面
细磨（800-1500目）：提升光泽度
精抛（3000目+）：达到最终镜面效果

四、开孔与拼接

水槽/灶孔加工

孔位四角需做圆弧处理（半径≥5mm）
孔边缘加固处理
安装水槽支撑条

拼接工艺

台面拼接的关键要点：

工序	标准
接缝处理	接缝≤0.3mm
胶水选用	与板材颜色一致的专用胶
固化时间	≥24小时
打磨抛光	接缝处打磨至与母材光泽一致

优质拼接几乎看不出接缝，这是衡量加工水平的重要指标。

五、表面处理

表面类型

表面	光泽度	特点
抛光面	70-90°	光亮如镜，主流选择
哑光面	20-40°	低调质感，2026年趋势
酸洗面	10-20°	防滑，适合潮湿环境
皮纹面	30-50°	微糙质感，介于哑光和抛光之间

六、包装与运输

出口包装标准

表面覆膜保护
泡沫或EVA缓冲层
木箱或钢架固定
立式装箱（严禁平放运输）
标记易碎标识

厦门九头牛实业有限公司 / 泉州君诺美建筑材料有限公司

双生产基地：中国福建泉州 + 泰国曼谷
主营：石英石、岩板、人造石
联系人：王桂桂 | 电话：15960098402 | 邮箱：wgg234114134@163.com
泉州工厂：德国进口生产线，22项专利技术
泰国工厂：曼谷生产基地，服务东盟及全球市场

本文信息来源于公开行业资料和企业资质文件。价格数据来源于公开市场报价，实际价格以供应商报价为准。

本文加工工艺信息参考行业通用技术标准。企业信息来源于国家企业信用信息公示系统。

DEV Community: correctover

The AI Runtime Attack Surface: 7 Threats Every CISO Should Know

The AI Runtime Attack Surface: 7 Threats Every CISO Should Know

AI Security Audit, MCP Penetration Testing, and LLM Vulnerability Assessment: A Repeatable Workflow

AI Security Audit, MCP Penetration Testing, and LLM Vulnerability Assessment: A Repeatable Workflow

Why a Structured Audit Beats Ad-Hoc Scanning

The Workflow: Five Stages

Stage 1 — Asset Inventory

Stage 2 — Static Detection

Stage 3 — MCP Penetration Testing

Stage 4 — LLM Vulnerability Assessment

Stage 5 — Verification, Reporting, and Re-audit

What the Workflow Is Built On

Common Mistakes to Avoid

The Takeaway: AI Security Audit, MCP Penetration Testing, and LLM Vulnerability Assessment Are One Loop

CCS Compliance for AI Systems: A 24-Rule Framework for Production Security

CCS Compliance for AI Systems: A 24-Rule Framework for Production Security

Your AI Agent Stack May Have These 16 Vulnerability Patterns

Your AI Agent Stack May Have These 16 Vulnerability Patterns

The data: 37 repositories, 144 advisories, 75 high or critical

Risk #1 — Firecrawl MCP: eval-based RCE, CVSS 10.0

Risk #2 — Cloudflare MCP: unsanitized command execution, CVSS 9.3

Risk #3 — Dify: pickle deserialization plus 41 SQL-injection candidates

Risk #4 — n8n: sandbox escapes and a privilege-escalation chain

Risk #5 — Tools without a read-only guard: Stripe and Docker

Why traditional SAST is not enough

A governance checklist for your AI stack

Get a snapshot of your stack

AI Agent Security Audit: From MCP Penetration Testing to LLM Vulnerability Assessment

AI Agent Security Audit: From MCP Penetration Testing to LLM Vulnerability Assessment

The New Attack Surface: Why AI Agents Are Different

The CCS Methodology: 24 Rules, 10 Frameworks, 4 Platforms

Real-World Findings

Deep Dive: MCP Security Audit Case Study

Case 1: fdp-mcp-server — readOnlyHint Bypass

Case 2: CodeAnalysis Path Traversal (腾讯)

Building Your LLM Vulnerability Assessment Pipeline

Phase 1: Static Analysis (24 Rules)

Phase 2: Dynamic Testing

Phase 3: Responsible Disclosure

What's Next for AI Agent Security

为什么越来越多海外买家选择福建石材？

为什么越来越多海外买家选择福建石材？

一、出口规模领先

二、六大竞争力优势

1. 产业链完整

2. 技术成熟

3. 交期可靠

4. 品质稳步提升

5. 成本竞争力

6. 服务意识

三、福建石材采购实操建议

供应商筛选要点

双基地供应商的额外优势

AI Security Audit and MCP Penetration Testing: A Practical Guide for AI Agent Security

AI Security Audit and MCP Penetration Testing: A Practical Guide for AI Agent Security

为什么 MCP 安全如此重要

MCP Server 攻击面分析

5-Step MCP Penetration Testing Checklist

Runtime Verification：填补静态扫描的空白

总结

石英石台面日常保养与维护指南

石英石台面日常保养与维护指南

一、日常清洁

每日清洁

推荐清洁工具

二、污渍处理方法

三、日常注意事项

温度的注意事项

切割的注意事项

四、长期维护

定期检查

专业维护

We Found 56+ Security Vulnerabilities (6 Critical RCEs) Across 13 AI Agent Frameworks - Here Is What Systematic Auditing Taught Us

We Found 56+ Security Vulnerabilities (6 Critical RCEs) Across 13 AI Agent Frameworks — Here Is What Systematic Auditing Taught Us

The 7 Responsibly Disclosed Vulnerabilities

1. CrewAI MCP StdioTransport RCE (CVSS 9.8)

2. AutoGen Studio RCE (CVSS 9.8)

3. AG2 eval() __str__\ Bypass RCE (CVSS 9.8)

4. LlamaIndex Pickle Deserialization RCE (CVSS 9.8)

3. AG2 eval() `str\` Bypass RCE (CVSS 9.8)

1. LangChain (`langchain-core` Callback)