Illustrative scenarioDate not recordedIllustrative scenario

Autonomous AI Agent Model Context Protocol Token Hijacking

Model Context Protocol search tool allowed prompt injection to leak bearer tokens in subagent prompt context.

Illustrative scenario, not a real incident

A composite failure pattern written by CollectSEA for learning and demos. It is NOT a documented real-world incident and has no primary source.

What happened

    Contributing factors stated by the source

    • Model Context Protocol search tool allowed prompt injection to leak bearer tokens in subag...

    The failure pattern

    AI action exceeds its intended scopeAn AI agent or assistant takes an action, or makes a promise, that nobody meant it to be able to make.How to prevent it Duplicate action after an ambiguous resultA request times out, the caller assumes it failed and retries, and the money moves (or the order ships) twice.How to prevent it
    Watch the pattern: AI action exceeds its intended scope

    Related standards

    CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

    Building something similar?

    Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

    Analyze your design

    Incidents with the same pattern

    Security advisory2026-10-16AI agent

    Security issue reported in Software component

    The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5.

    AI action exceeds its intended scopenvd.nist.gov
    Security advisory2026-10-16AI agent

    Software component issue could run attacker-controlled scripts in a browser

    Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the…

    AI action exceeds its intended scopenvd.nist.gov
    Security advisory2026-10-16AI agent

    Security issue reported in @aborruso/ckan-mcp-server

    The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage.

    AI action exceeds its intended scopegithub.com
    Security advisory2026-10-15AI agent

    Security issue reported in Software component

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before…

    AI action exceeds its intended scopenvd.nist.gov