Mend.io Releases Guide for Securing AI Agents and LLM Apps

Mend.io has released a new practitioner guide titled 'Securing AI agents, MCP servers & LLM apps: A practical framework,' aimed at addressing the security challenges posed by the rapid integration of AI agents, Machine Control Plane (MCP) servers, and Large Language Model (LLM) applications into codebases. The guide acknowledges that traditional Application Security (AppSec) approaches are insufficient for these new technologies because agentic AI behavior is emergent, stemming from a complex interplay of models, system prompts, retrieved context, user input, and available tools. This emergent behavior means that identical deployments can exhibit different functionalities and failure modes, which are not typically captured by conventional security measures like CVE feeds. For instance, prompt injection can occur through data rather than code, and over-permissioned agents can execute harmful actions without exploiting traditional vulnerabilities. Furthermore, deprecated models may continue to provide predictions even after their maintainers cease patching them, and poisoned tool descriptions on MCP servers can subtly alter an agent's actions without direct modification of the application code. The framework proposed by Mend.io advocates for a two-pronged approach: shifting security efforts 'left' to address issues earlier in the development lifecycle and implementing robust protections 'right' in production environments. The guide introduces seven reusable artifacts to support this process. One key artifact, 'Artifact 1.1: the five-layer attack surface map,' categorizes potential threats across different components of an AI system. These layers include Interaction (user inputs, documents, inter-agent messages) susceptible to prompt injection and data exfiltration; Agent (system prompts, configurations, memory) vulnerable to over-permissioning and goal hijacking; Integration (MCP servers, tool definitions, APIs) at risk from poisoned tool descriptions and shadow servers; Model (foundation and fine-tuned models, embeddings) facing risks from end-of-life models and supply chain issues; and Code (AI-generated code, frameworks, SDKs) which can contain vulnerable code or malicious packages. The guide emphasizes the need for discovery mechanisms to identify these AI components, as agents often bypass standard procurement processes. It identifies three primary categories to hunt for: shadow agents, unregistered MCP servers, and embedded AI frameworks. For each MCP server, the guide mandates clear ownership, defined access scopes, and regular review processes to maintain security and control. This comprehensive approach aims to equip security professionals with the necessary tools and strategies to manage the evolving threat landscape of AI-powered applications.