The Emerging Risk: How AI Agents Could Threaten Cryptocurrency Security

AI entities in crypto are progressively integrated into wallets, trading bots, and on-chain assistants that automate tasks and make instantaneous decisions.

Although it isn’t a widely recognized framework yet, Model Context Protocol (MCP) is gaining traction at the center of many of these entities. Just as blockchains utilize smart contracts to detail what actions should take place, AI agents employ MCPs to determine how those actions can manifest.

It can serve as the governance layer that oversees an AI agent’s conduct, such as which resources it employs, what code it executes, and how it reacts to user interactions.

This very adaptability also presents a considerable attack surface that can enable malicious plugins to override commands, taint data inputs, or deceive agents into executing harmful commands.

MCP attack vectors reveal AI agents’ security vulnerabilities

As reported by VanEck, the quantity of AI agents within the crypto sector surpassed 10,000 by the conclusion of 2024 and is projected to exceed 1 million by 2025.

The security company SlowMist has identified four potential attack vectors that developers ought to be cautious of. Each attack vector is delivered through a plugin, which is how MCP-based agents augment their functionalities, whether it involves retrieving price data, executing trades, or undertaking system tasks.

• Data poisoning: This assault leads users to take misleading actions. It manipulates user behavior, constructs false dependencies, and injects harmful logic early in the workflow.

• JSON injection attack: This plugin fetches data from a local (potentially malicious) source via a JSON request. It can result in data leakage, command manipulation, or sidestepping validation mechanisms by supplying the agent with compromised inputs.

• Competitive function override: This method bypasses legitimate system functions with harmful code. It obstructs expected operations from occurring and embeds obscured instructions, disrupting system logic and concealing the attack.

• Cross-MCP call attack: This plugin compels an AI agent to interact with unverified external services via encoded error messages or misleading prompts. It enhances the attack surface by connecting multiple systems, creating chances for further exploitation.

These attack vectors are not equivalent to the poisoning of AI models themselves, such as GPT-4 or Claude, which may involve corrupting the training data that shapes a model’s internal attributes. The attacks highlighted by SlowMist target AI agents — which are systems constructed on top of models — that operate on real-time inputs utilizing plugins, tools, and control protocols like MCP.

Related: The future of digital self-governance: AI agents in crypto

“AI model poisoning involves infusing harmful data into training samples, which subsequently becomes ingrained in the model parameters,” the co-founder of blockchain security firm SlowMist “Monster Z” stated to Cointelegraph. “Conversely, the poisoning of agents and MCPs primarily results from extra harmful information introduced during the model’s interaction phase.”

“In my opinion, [the poisoning of agents] poses a greater threat level and privilege scope compared to that of isolated AI poisoning,” he remarked.

MCP in AI agents a risk to crypto

The incorporation of MCP and AI agents is still quite nascent in crypto. SlowMist recognized the attack vectors from pre-released MCP projects it reviewed, which diminished actual losses to end-users.

Nonetheless, the magnitude of MCP security flaws is markedly tangible, according to Monster, who recounted an audit where the vulnerability might have resulted in private key leaks — a disastrous situation for any crypto project or investor, as it could grant complete asset control to unwelcome parties.

“When you open your system to third-party plugins, you’re broadening the attack surface beyond your control,” stated Guy Itzhaki, CEO of encryption research firm Fhenix, to Cointelegraph.

Related: AI faces a trust dilemma — Decentralized privacy-preserving technology can remedy it

“Plugins can function as trusted code execution pathways, often without adequate sandboxing. This paves the way for privilege escalation, dependency injection, function overrides, and — most critically — silent data leaks,” he further added.

Securing the AI layer before it’s too late

Develop rapidly, break things — then face hacking challenges. That’s the risk confronting developers who delay security measures until the second version, particularly in crypto’s high-stakes, on-chain landscape.

The most frequent blunder builders commit is presuming they can remain unnoticed for a period and implement security precautions in later updates following the launch. This perspective is as per Lisa Loud, executive director of Secret Foundation.

“When creating any plugin-based system today, especially within the context of crypto, which is transparent and on-chain, security must be prioritized first and everything else as secondary,” she advised Cointelegraph.

SlowMist security specialists advocate that developers enforce rigorous plugin validation, apply input sanitization, adopt least privilege principles, and consistently review agent behavior.

Loud asserted that it’s “not challenging” to incorporate such security checks to avert harmful injections or data poisoning, merely “laborious and time-consuming” — a minor cost to safeguard crypto assets.

As AI agents broaden their reach in crypto infrastructure, the necessity for proactive security cannot be overstated.

The MCP framework may unlock potent new functionalities for these agents, yet without solid guardrails around plugins and system conduct, they might transform from useful assistants into attack vectors, endangering crypto wallets, assets, and information.

Magazine: Crypto AI tokens soar 34%, why ChatGPT is so impressive: AI Eye