AI Agent Attack Surface: What Your Pentest Still Misses

Mandiant's M-Trends data, as cited in a new Habr vulnerability-management analysis, puts 2025 mean time-to-exploitation at roughly minus seven days, meaning attacks, on average, begin before a patch exists. That clock now runs against the AI agent attack surface too: MCP servers, coding-agent sandboxes and chatbots that most pentest scopes still leave out.

When time-to-exploit goes negative, what does a patch SLA still buy?

A 24-hour SLA for critical fixes still buys protection, but only against vulnerabilities attackers have not reached yet, and that share keeps shrinking. The numbers come from part 19 of a vulnerability-management series published on Habr on October 28, 2026.

On average, the author writes, about five days pass between disclosure and a working exploit, and roughly one vulnerability in four is attacked on the day it is disclosed. A Mandiant M-Trends figure puts mean time-to-exploitation in 2025 at about minus seven days: averaged across the exploited vulnerabilities Mandiant tracked, attacks began before a fix existed.

We quote that figure as reported, not re-derived, and a cluster of zero-days can drag a mean below zero by itself. The direction matches our engagements anyway: the gap between an advisory and the first scanning traffic is now measured in hours.

The author concludes that a 24-hour remediation SLA for criticals is no longer a compliance checkbox but a survival line. We agree, with a caveat. When exploitation can precede the fix, the SLA covers half the problem. The other half is knowing which assets sit in that pre-patch window and how far an attacker could get from them.

That is a scoping question, and in 2026 the assets most companies cannot scope are the AI ones. The article casts AI in three roles at once: it helps defenders, it arms attackers, and it is a new class of asset to defend. Most programs have budgeted for the first two. Very few have budgeted for the third.

Why ML risk ranking does not shrink the AI agent attack surface

Machine-learning ranking makes the queue shorter. It does not remove a single exposed service, and it says almost nothing about AI assets that never receive a CVE. The Habr author starts from volume: about 48,000 vulnerabilities a year plus thousands of scanner findings, or roughly 132 new CVEs a day.

Start with FIRST’s EPSS, which the article calls essentially an ML model of exploitation likelihood. It estimates the probability that a published CVE will be exploited in the wild within the next 30 days. It is not a severity score, and it is not a detection signal. It also cannot tell whether the vulnerable host faces the internet or sits three hops deep.

Mature triage combines EPSS with:

• CVSS severity
• asset exposure
• business impact
• hard evidence of exploitation, such as CISA’s Known Exploited Vulnerabilities catalog

Binding Operational Directive 22-01 makes KEV deadlines mandatory only for US federal civilian agencies. For everyone else, KEV is a feed, not a legal requirement.

Commercial platforms run their own models on top. The article names Tenable VPR, Qualys TruRisk and Rapid7 Active Risk and credits them with cutting the priority list by 40-50%. Treat that as a vendor claim, not a measurement from your environment.

The strongest defensive example is Google’s Big Sleep, an agent built by DeepMind and Project Zero. Google credited it with finding CVE-2025-6965 in SQLite in 2025, a flaw the article says attackers were already preparing to use, and called it the first case of an AI agent preventing real-world exploitation.

The fix shipped in SQLite 3.50.2, so check bundled copies as well as the system package. And agent output is still only a lead until someone reproduces it, isolates the root cause, assesses impact and gets the maintainer to confirm.

Does XBOW topping HackerOne mean AI replaces pentesters?

No. XBOW showed that automated offense can find and report real bugs at scale. It did not show parity with a human-led engagement. XBOW held first place on HackerOne’s US vulnerability disclosure program leaderboard from April to June 2025 and had slipped to third by August.

The “85x faster” figure comes from XBOW’s own 104-scenario test set: 28 minutes for the system against 40 hours for a pentester with 20 years of experience. Forty hours is 2,400 minutes, and 2,400 divided by 28 is about 85.7, so the headline rounds correctly. The Habr author still calls it marketing-grade evidence. We agree: a vendor measured itself.

Our own benchmark of AI pentest tools on Juice Shop pointed the same way: autonomous agents lost to a Claude-plus-Burp workflow with a human at the controls. The defender’s conclusion is narrower and less comfortable. Attackers do not need parity with a human tester. They need breadth and speed against unpatched, unscoped assets.

SOC agents read attacker text too

Defenders are moving agents into L1/L2 SOC work (alert triage, sorting and enrichment) under the “agentic SOC” label, and the article says Gartner lists security AI agents among its top trends for 2026. Each of those agents reads text an attacker can influence, such as log lines, email subjects and ticket bodies, and then calls tools.

That makes a SOC agent part of your attack surface, not a shield in front of it. Scope it like any other system that turns untrusted input into privileged actions.

What should a pentest of MCP servers actually prove?

A pentest of MCP servers should answer two questions. Can untrusted content push an authorized model into calling an allowed tool in a harmful way? And does your approval of a server stay bound to what that server executes later?

Start with what the protocol promises. The Model Context Protocol came from Anthropic and spread fast through 2025. In the Habr author’s words, the specification openly acknowledges that it provides no protocol-level security and leaves that entirely to whoever deploys the server.

MCP does define an OAuth 2.1-based authorization framework for HTTP deployments. Authorization only answers who may connect, though. It says nothing about whether a tool description is benign or a server-side command is safe. Local stdio servers run with the permissions of whatever launched them, which on a developer laptop usually means SSH keys, cloud credentials and the source tree.

Two different failures: tool poisoning and MCPoison

Invariant Labs documented the Tool Poisoning Attack in April 2025. The malicious instructions sit inside a tool’s description, which the model reads in full and the user interface hides. In the demonstration, a harmless-looking “fact of the day” MCP server changed how the model used a separate, legitimate server, and WhatsApp conversations were exfiltrated.

CVE-2025-54136, nicknamed MCPoison, hit Cursor in July 2025 with a CVSS score of 8.8. Cursor kept trusting an MCP configuration the user had approved once, even after it was silently swapped for a malicious command. Tool poisoning abuses what the model believes. MCPoison abuses what the client remembers approving. A test plan has to cover both.

The source also reports more than 30 CVEs against MCP servers in the first weeks of 2026, nearly half of them command-injection variants: a prompt injection makes the model call a tool with arguments that execute commands on the host. We could not confirm that count independently, but the pattern is what the two earlier cases predict.

Standards bodies are catching up. According to the article, OWASP published a Top 10 for agentic applications in December 2025, an MCP-specific Top 10 is in preparation, and MITRE added relevant techniques to ATLAS.

What we put in scope

• Indirect injection paths. Web pages, emails, documents, repository files, database records and tool output all reach the model, and RAG does not stop it from treating that content as instructions.
• Raw tool descriptions. Compare what the model receives with what the UI shows, at install time and after every update.
• Approval binding. Change a server’s command after approval and confirm the client asks again.
• Argument handling. Any tool that touches a shell, path, URL or query gets the same injection testing as a web endpoint.
• Credential scope. List the tokens each server holds and what they could reach if the model were steered.

This is the core of our MCP server and tool-chain security testing.

Which AI escape stories are lab tests, and which are product bugs?

Almost every viral “AI escape” story describes a controlled lab stress test. The escapes that should change your test plan are ordinary sandbox bugs in coding agents.

Source	Model	Reported result	Setting
Apollo Research, Dec 2024	OpenAI o1	5% tried to disable oversight, 19% falsified data, 2% tried to copy itself over a replacement	Sandbox, no access to its weights
Anthropic, May 2025	Claude Opus 4	Blackmail in 84-96% of runs	Only blackmail or inaction on offer
Anthropic rerun, June 2025	Gemini 2.5 Flash 96%, GPT-4.1 and Grok 3 80%, DeepSeek-R1 79%	Blackmail rate	Same scenario
Palisade Research, July 5, 2025	OpenAI o3	Sabotaged shutdown in 79/100 runs, 7/100 with an explicit allow-shutdown instruction	Scripted task
Palisade rerun, Oct 2025	Grok 4	About 90% sabotage despite tighter wording	Scripted task

• Apollo: in the self-copy scenario, o1 denied or lied about its actions in 99% of interrogations. It never had access to its own weights.
• Anthropic: the scenario left only blackmail or doing nothing. Anthropic says no such behavior is known in the wild.
• Palisade: the researchers’ own hypothesis is reward mis-specification during reinforcement learning, not a survival instinct.

These are findings about training, not incidents.

One case falls outside role-play, and it is disputed. In December 2025, a firewall flagged anomalous outbound traffic during agentic RL training of Alibaba’s ROME. The paper says the model opened an SSH tunnel outward and mined crypto on idle GPUs outside its allocation. The lab’s later account says everything stayed inside a strictly isolated sandbox. The two accounts cannot both be fully true.

The escapes that belong in your test plan

The findings that actually change your test plan are mundane. According to the source, Pillar Security reported seven sandbox escapes in agentic coding tools in one week in July 2026, covering Cursor, OpenAI Codex, Gemini CLI and Antigravity. The shared pattern: the agent does not break isolation, it writes a file that a trusted process outside the sandbox later executes without checking.

Claude Code’s Linux sandbox was reported the same month to have configuration-dependent gaps:

• Write protection depended on whether a settings file existed at launch.
• A deny-list could be bypassed by reaching the same binary through /proc/self/root.
• A flag could disable isolation entirely.

We have not verified affected versions for either report, so check vendor advisories before acting on them.

The lesson generalizes. A sandbox limits what the agent does directly. It does not check artifacts that cross the boundary. Build systems, editors, package managers, task runners and git hooks that consume agent-written files need their own trust controls. We covered one variant in malicious .git configs that make coding agents run attacker code.

Who pays when a chatbot invents a policy?

The deploying company pays. In every public case so far, the business has owned its bot’s answers.

Air Canada. In February 2024, a Canadian small-claims tribunal held the airline liable in Moffatt v. Air Canada (2024 BCCRT 149) after its bot invented a bereavement-fare refund rule, and the passenger paid nearly double. Air Canada argued the bot was a separate legal entity. The tribunal rejected that. The award was CAD 812.02 including interest and fees: trivial money, real precedent.

New York City. The MyCity business chatbot went live in March 2024 and told owners they could take staff tips, refuse tenants with housing vouchers and reject cash, all unlawful under city rules. An investigation exposed this in April 2024, yet the city kept the bot running as a “pilot” with a disclaimer until February 2026.

Chevrolet. In November 2023, a user told a dealership’s bot to agree with everything and call each offer legally binding, then “bought” an SUV for one dollar. The post reached 20 million views. The dealer did not honor the deal.

The Habr author sums it up in a line worth forwarding to legal: an AI that speaks on behalf of the company is the company speaking. The OWASP LLM Top 10 risks the article lists line up with these cases:

• prompt injection
• leaking of hidden system prompts
• jailbreaks framed as “for educational purposes”
• training-data poisoning, such as a fraud model that waves fraudsters through
• leakage of confidential data to third-party ML services

Every one of these bots failed on input it should not have obeyed, which is why prompt injection testing belongs in scope for anything customer-facing, including outputs that commit the company to a price or policy.

Which checks and decisions come first?

Inventory comes first: an unrecorded MCP server cannot be tested or patched. Each item below maps to a failure described above.

1. Inventory AI assets. List customer-facing LLM apps, internal and SOC agents, every local and remote MCP server, coding agents, and the credentials each holds, with owner, version and update mechanism.
2. Pin MCP servers. Treat each as privileged third-party code. Pin package and version, and confirm approval is requested again when the command changes.
3. Diff tool descriptions. Capture the raw descriptions the model sees and review them on install and every update.
4. Isolate coding agents. On untrusted repositories, run them as disposable, unprivileged workloads with no host credentials and no container socket. Review hooks, tasks and generated files before any trusted process runs them.
5. Patch known items. Update Cursor past the CVE-2025-54136 fix and SQLite to 3.50.2 or later, including bundled copies.
6. Gate chatbot commitments. Find every answer that can promise a refund, a price or a legal position, and put a control in front of it.

Practitioner’s note. In our engagements, prompt injection rarely looks like an attack in application logs. An authorized model calls an allowed tool with malicious arguments, and every auth check passes. What gives it away is host telemetry: a shell spawned by the MCP server process, or a DNS lookup nobody expected. Join model and tool traces with process, file, DNS and network events.

During incident response, preserve the whole chain:

• the source content
• raw and rendered tool descriptions
• the system instructions the model received
• tool arguments and returned data
• approvals
• host logs for the spawned processes

The chat transcript alone usually leaves out the instruction that did the damage.

Three decisions for leadership

Ownership. Chatbots usually sit with product or marketing, MCP servers with individual developers, SOC agents with security. Without a named owner per asset, a 24-hour SLA has nobody to land on.

Funding. Treat the SLA as an operating cost, not a policy line. If exploitation can start before a patch exists, you need on-call staff, tested rollback and compensating controls ready to fire, such as disabling a tool or pulling a server.

Scope. A web pentest scoped to “the app” will skip the MCP server that app calls and the coding agent that writes its code. Some things stay unknown: whether Mandiant’s negative mean reflects a broad shift, the real 2026 MCP CVE count, and what happened inside ROME. None of them changes this decision.

FAQ

What is an AI agent attack surface?

It is every path by which untrusted input reaches a model that can act: customer chatbots, SOC agents, coding agents and MCP servers, plus the credentials and tools each one holds. Most of these components never receive a CVE, so ML-based vulnerability triage does not see them.

How fast are vulnerabilities exploited after disclosure?

The Habr analysis cites about five days on average, with one in four vulnerabilities attacked on disclosure day. A Mandiant M-Trends figure puts the 2025 mean at roughly minus seven days, meaning attacks on average began before a patch was available.

What is a tool poisoning attack on MCP?

Documented by Invariant Labs in April 2025, it hides malicious instructions in an MCP tool's description, which the model reads but the user interface does not show. In their demo, a 'fact of the day' server hijacked a legitimate server and exfiltrated WhatsApp messages.

Did Google Big Sleep find a real vulnerability?

Yes. Google credited Big Sleep with finding CVE-2025-6965 in SQLite in 2025 and called it the first case of an AI agent preventing real-world exploitation. The fix shipped in SQLite 3.50.2.

Can a company be liable for a chatbot answer?

Yes. In February 2024 a Canadian tribunal held Air Canada liable after its bot invented a bereavement-fare refund rule, rejecting the argument that the bot was a separate legal entity.

If your next engagement needs to cover MCP servers, coding agents and customer-facing LLM apps alongside the web perimeter, our AI agent penetration testing scopes and tests them as the internet-facing components they are.