Compositional risk in MCP systems can trigger code execution

At a glance

What this is: This is an analysis of how MCP systems can be pushed from safe-looking components into code execution through dangerous composition and trust chaining.

Why it matters: IAM, NHI, and agent governance teams need to treat cross-tool delegation, context resets, and untrusted inputs as access-control problems, not just application-security problems.

Context

MCP composition risk emerges when individually trustworthy components create a larger attack path that none of them exposes alone. In this article, the primary issue is not a vulnerable server but the governance gap created when an LLM host, a messaging source, and an execution-capable plugin are combined.

For identity and access programmes, that means the trust boundary moves from the single service account or tool to the way the system chains permissions across tools. In agentic environments, the relevant question is no longer whether each component is approved, but whether the composition permits untrusted input to reach execution.

This is a clear example of agent-mediated access becoming risky even before full autonomy enters the picture. The article’s scenario is an illustrative test case, not an isolated software flaw.

Key questions

Q: What breaks when MCP integrations are allowed to pass untrusted input into command execution paths?

A: They stop being passive connectors and become execution surfaces. If configuration, endpoint parameters or tool metadata can reach the shell without strict validation, an attacker can turn a trusted AI integration into remote code execution, configuration tampering or lateral movement. The failure is architectural, because the boundary was never enforced where the action actually happened.

Q: Why do compositional attacks matter more than isolated tool security in MCP systems?

A: Because isolated approval of each component does not control the behaviour of the chain. In MCP environments, the important security question is whether one tool’s output can steer another tool into a higher-risk action. When that happens, the real control failure is the interaction layer, not the component list.

Q: How can security teams tell whether an agent workflow is too easy to chain into abuse?

A: Look for any path where external content, model reasoning, and privileged tool calls can occur without a separate decision point between them. If the same workflow can ingest, interpret, and act, then the design is already giving attackers a place to amplify benign-looking input into execution.

Q: What should teams do before allowing shells or write access in an MCP host?

A: They should verify that the host cannot inherit trust from a planning step or a prior conversation when it reaches execution. If shell or write access exists, it needs an explicit policy barrier that evaluates the final action, not just the upstream content that inspired it.

Technical breakdown

How compositional risk turns trusted tools into an attack path

Compositional risk is the security failure that appears when multiple trustworthy components together create an unsafe system state. In an MCP setup, a host application mediates access to tools, the model interprets content, and plugins may hold execution permissions or data access that were never intended to be combined with hostile input. Each piece can be behaving correctly in isolation while the overall chain still becomes exploitable. That is why the article’s example matters: the exploit is not a single broken server, but a trust graph that lets one tool’s output influence another tool’s action.

Practical implication: Map tool-to-tool trust chains, not just individual approvals, and treat composition as the unit of control.

Why context resets matter in LLM-driven workflows

A context reset means the model does not retain durable memory of prior safety reasoning unless the surrounding system preserves it. That matters because an attacker can use earlier interactions to shape the model’s planning, then start a fresh session where the agent behaves without that same conversational history. In the article, the reset allowed the attacker to separate planning from execution and use the model’s own reasoning to refine the malicious path. This is not a classic vulnerability in the host alone, but a workflow property that weakens assumptions about stable judgment across sessions.

Practical implication: Do not assume safety decisions made in one session persist into the next session or another tool invocation.

Cross-tool invocation and permission amplification

Cross-tool invocation is the ability of one component to cause another component to act. In agentic systems, that becomes dangerous when an untrusted input can steer a model into calling tools with broader capability than the original input should ever have reached. The article’s Gmail-to-shell path shows how execution permission becomes reachable through a sequence of otherwise legitimate steps. This is the kind of risk that static component reviews miss, because the abuse emerges only when trust, instruction flow, and execution capability are combined into one runtime path.

Practical implication: Separate data ingestion from execution authority and review whether any tool can indirectly trigger privileged action.

Threat narrative

Attacker objective: The attacker’s objective is to turn trusted agent workflow into code execution without needing a vulnerable component in isolation.

1. Entry occurs through a crafted Gmail message that reaches the MCP host as apparently ordinary untrusted content.
2. The model uses the message content and session dialogue to reason about possible attack paths and refine the payload.
3. Cross-tool invocation reaches a shell-capable MCP plugin, which turns the composed trust chain into code execution.
4. Impact is achieved when the hostile message, model guidance, and tool permissions combine into a successful execution path.

Breaches seen in the wild

• Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.
• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Composition, not component weakness, is the real control boundary: The article demonstrates that secure-looking MCP parts can still form an exploitable system when trust flows across tools without a governance layer that understands the whole chain. That is a different problem from patching a server or hardening a plugin. Practitioners should stop reviewing MCP components one by one and start reviewing the permission path the composition creates.

Context reset is an access-control assumption, not just a UX detail: The attack works because the model can carry planning knowledge forward in a way the operator can exploit, then lose the visible trace that should have constrained the next session. That shows how ephemeral conversational state can be used to bypass human expectations about continuity and review. The implication is that safety cannot depend on a prior prompt thread surviving into the next turn.

Agentic systems need governance for cross-tool intent, not only tool approval: An MCP host that permits a model to move from message intake to execution-capable action has already crossed an identity boundary, even if every individual tool was authorised. The article sharpens the idea of a compositional trust gap: permissions that look safe at the component level can become unsafe when chained. Practitioners should treat cross-tool invocation as a first-class governance object.

Human review does not scale to model-in-the-loop attack refinement: The article shows the model being used to iterate on its own bypass strategy, which means a reviewer would be inspecting a moving target rather than a fixed payload. That breaks the assumption that one approval step can validate a stable action path. Security teams need to recognise that the malicious logic may live in the sequence, not the final command.

Named concept: compositional trust debt: When each tool carries its own acceptable risk but the combined workflow is not bounded, the organisation accrues trust debt at the system level. This debt is paid out when an untrusted input can traverse the chain into execution. The practitioner implication is to govern the composition as the asset, not merely the endpoints.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: MCP Security Guide

What this signals

Compositional trust debt: The article’s most useful contribution is the idea that risk accumulates in the workflow between approved parts, not only inside the parts themselves. That means agent governance programmes should measure where trust is inherited across tools, because the exploit path often appears only after components are composed into a single action chain.

MCP-hosted workflows should be evaluated like delegated access systems: the question is whether untrusted input can cross from reading to acting without an intervening policy decision. If the answer is yes, the organisation has not just a tool-security problem but a governance problem that can survive component hardening.

For practitioners

• Define composition-level trust boundaries Document where untrusted input can move from ingestion into model reasoning, tool selection, and execution-capable actions. Review the full path, not just the security of each individual MCP server or plugin.
• Separate content handling from execution authority Ensure the system that reads external content cannot directly trigger tools with shell or write privileges unless a separate policy gate approves the transition.
• Reset review state between sessions Treat each session as a new governance event and verify whether prior safety reasoning, approvals, or red-team findings are being reused as if they still apply.
• Test for cross-tool escalation paths Red-team scenarios where harmless-looking inputs cause tool chaining, especially from messaging, retrieval, or planning surfaces into execution surfaces.

Key takeaways

• The article shows that code execution can emerge from an MCP composition even when no single component is vulnerable on its own.
• The risk sits in the handoff between untrusted input, model reasoning, and privileged tool invocation rather than in one broken server.
• Security teams need to govern the composed workflow as the control object, because component-by-component review leaves the attack path intact.

Key terms

• Compositional Risk: The security risk that emerges from combining individually acceptable components into an unsafe end-to-end workflow. In MCP and agentic environments, the danger is often not a broken server but a delegation path that lets untrusted input influence privileged action.
• Context reset: The loss of session continuity that forces a model or agent to start a new conversational state. In governance terms, this can erase the visible trail of prior reasoning, so the next action may no longer be constrained by earlier safety decisions.
• Cross-tool Invocation: A behaviour where one tool, session, or model output causes another tool to take action. In identity terms, it is a privilege transfer problem because the trust level of the input may be far lower than the trust level of the action it triggers.
• Compositional Trust: A security condition where several individually acceptable capabilities become risky only when combined. This is common in agentic systems, where messaging, shared state, tools, and credentials can assemble into an authority level nobody intended to approve.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.