Orchestration and Tool Surfaces

AI orchestration frameworks connect language models to external tools, APIs, databases, and services. Frameworks like LangChain, AutoGen, CrewAI, and direct MCP implementations manage tool selection, argument construction, and result handling on behalf of the model. Each connected service is reachable through the orchestrator, and the orchestrator's trust in model-generated tool calls is the core exploitation primitive.

When a model can be influenced — through user input or injected content — into constructing malicious tool call arguments, those arguments execute against backend services with the agent's credentials. The attack surface scales with the number of tools connected: more integrations means more pivot points, more credentials in the environment, and more actions an attacker can trigger through the model layer.

Pages in This Section

Model Context Protocol Abuse for Privilege Escalation covers enumerating MCP tool definitions, calling privileged tools directly against exposed MCP servers, causing the AI orchestrator to invoke restricted tools through prompt injection, and hosting malicious MCP servers that inject instructions through tool response payloads.

Tool Integration Exploitation covers command injection through shell tool arguments, SQL injection via database tool parameters, and path traversal through file tool arguments — all routed through the agent layer rather than direct service access.

Exploiting Over-Permissioned Agent Tool Scopes covers mapping excessive permissions granted to agent service accounts, abusing write-enabled tool scopes to plant web shells and send unauthorized communications, and exploiting shared agent identities for cross-user data access.

Lateral Movement Through AI Orchestration Frameworks covers using agent HTTP tools as an SSRF proxy to reach internal services, retrieving IAM credentials from cloud metadata endpoints, and pivoting to Kubernetes API servers through pod service account tokens.

Abusing Function Calling to Reach Unintended System Resources covers forcing unintended function calls through prompt injection, manipulating function arguments to access out-of-scope resources, intercepting and replaying modified function call JSON, and enumerating the full function schema through model disclosure.