Web3 turns agent tool flaws into irreversible loss

Problem

The paper studies the security consequences when autonomous AI agents invoke tools that transact on public blockchains. It argues that the blockchain execution layer - characterised by irreversibility, signing authority, continuous autonomy and sequence-level composition - qualitatively amplifies ordinary agent-tool failures into standing, irreversible loss. This matters because agent tool use that modifies external state is rising rapidly in the Model Context Protocol ecosystem, and many deployed tools and servers exhibit protocol and implementation weaknesses that an attacker can exploit to induce harmful on-chain actions.

Approach

This is a survey that organises existing MCP-security literature into an attack-surface taxonomy and constructs a Web3 risk-mapping matrix. The authors analyse MCP, tool calling, skills and surrounding protocols, then map confirmed vulnerabilities and documented incidents to attack classes located by where they enter the stack (user, client-host, transport, server) and when they act in the tool pipeline (task planning, tool invocation, response handling). They quantify ecosystem trends and cite measured benchmarks and industry scans to ground prevalence and mitigation effectiveness.

Key Findings

• Agent action is increasing: across 16 months MCP tool use that modifies state rose from 27% to 65% while distinct tools grew from about 5,000 to over 177,000.
• A compact taxonomy of attack classes is presented, including tool poisoning, indirect prompt injection, command and STDIO injection, remote code execution, sandbox escape, authentication gaps, supply-chain compromise, preference manipulation and identity impersonation.
• Tool-poisoning is especially potent because MCP supplies tool descriptions as trusted context; one benchmark reports a 72.8% attack success rate for tool-poisoning while safety-tuned models refuse below 3% of such prompts, indicating model-level alignment is largely ineffective.
• An industry analysis across 2,614 MCP deployments reported path-traversal, code-injection and command-injection weaknesses in 82%, 67% and 34% of implementations respectively, and marketplaces have seen hundreds of malicious skills proliferate as registries grew.
• The Web3 risk-mapping matrix ties each attack class to amplified impacts via four amplifiers: irreversibility makes on-chain harm permanent; signing authority makes the blast radius financial; continuous autonomy removes human reaction windows; sequence-level composition enables harmful trajectories of permitted calls.
• Existing mitigations - gateways, provenance and signing, custody improvements, policy-constrained wallets and identity authentication - improve resilience but remain insufficient: measured protections stop fewer than 30% of attacks on average and model refusal rates remain below 3% for poisoning.

Limitations

The survey is scoped to the usage-to-risk direction (agents as victims or conduits, not as autonomous exploit generators) and anchors claims to confirmed incidents. The risk-mapping assigns qualitative severity rather than numerical scores and the rapidly evolving MCP ecosystem means findings reflect the literature and measurements available at the time.

Implications

From an offensive security standpoint, compromised or malicious MCP components can induce irreversible financial loss by causing signed transactions to settle; sequence-level attacks can evade per-call defences; impersonation or over-permissioning of agents grants attackers on-chain signing authority; and continuous autonomous operation shortens or removes human intervention windows. These properties make tool-poisoning, supply-chain and injection attacks especially attractive vectors for attackers seeking permanent value extraction on Web3.