Zero-Click Exploit Targets MCP and Linked AI Agents to Stealthily Steal Data

Operant AI’s security team has identified a zero-click attack called Shadow Escape that exploits the Model Context Protocol to steal data through AI assistants. The attack works with widely used platforms such as ChatGPT, Claude, Gemini, and other MCP-enabled AI agents that access organisational systems, enabling the exfiltration of sensitive records from CRM, Google Drive, SharePoint and internal databases.

It operates within trusted boundaries, making it difficult for standard security controls to detect, and the adversary’s malicious instructions are triggered by seemingly ordinary PDF content, then executed by the MCP-enabled capability to make HTTP requests to an external endpoint. The exfiltration is masked as routine performance tracking, and employees may not realise data theft is occurring.

According to Donna Dodson, former head of cybersecurity at NIST, the Shadow Escape attack highlights the need to secure MCP and agent identities, with Operant AI reporting the issue to OpenAI and filing a CVE to address the threat.