AI AppSec Security Review

Internal - Version 0.1.0

AI AppSec Security Review

Request changes: high-risk issues require remediation before approval.

TargetExample AI Agent Platform

Date2026-05-12

AuthorAI AppSec Reviewer

Risk PostureModerate

Executive Summary

Verdict: Request changes: high-risk issues require remediation before approval.

Risk posture: Moderate based on 1 normalized finding(s).

Severity

Critical 0

High 1

Medium 0

Low 0

Informational 0

Scope and Authorization

Environment

local/staging

Access Level

source + imported scanner evidence

Authorized

True

Excluded

Production active scanning
Credentialed cloud posture review

Included

LLM prompt flow
MCP tool manifest
Agent web fetch tool
Scanner finding import

Methodology

Frameworks

OWASP LLM Top 10
OWASP Agentic Top 10
OWASP AIVSS
MITRE ATLAS
NIST AI RMF GenAI Profile

Agents Used

Security Orchestrator
Latest Threat Intel
MCP Server Auditor
Secure Code Review
Finding Correlator
Report

Evidence Sources

SonarQube imported evidence

MCP Policy

Escalation-only; local evidence and imported reports were preferred.

Skill Coverage and Specialist Notes

This review used a focused subset of specialists because the input combined source review with imported scanner evidence.

Security Orchestrator

Used

Focus

Scope, authorization, severity, and final verdict

Coverage

Confirmed local/staging scope and avoided live scanner or MCP actions.

Latest Threat Intel Agent

Used

Focus

Per-finding threat context and source freshness

Coverage

Added source-linked threat intel for the SSRF/tool-abuse finding.

MCP Server Auditor

Used

Focus

Tool boundary and least-privilege review

Coverage

Reviewed the agent fetch tool as an MCP-adjacent privileged action.

Report Agent

Used

Focus

Detailed HTML/PDF deliverable

Coverage

Converted the normalized finding into a findings-first report with fixes and tests.

Threat Intelligence

As of 2026-05-28

The current threat context for agentic systems emphasizes prompt injection reaching tools, excessive agency, MCP authorization boundaries, SSRF controls, and traceable governance evidence.

Prompt injection to privileged tools

Why It Matters

OWASP LLM 2025 keeps prompt injection and excessive agency in scope for GenAI apps, and the reviewed issue allows model-influenced URLs to reach a network-capable tool.

Recommended Action

Enforce deterministic URL validation, egress controls, approval gates, and logging outside the model.

MCP SSRF and token boundary risk

Why It Matters

MCP security guidance calls out SSRF, token passthrough, scope minimization, and authorization validation as key implementation risks.

Recommended Action

Bind tokens to intended audiences, avoid token passthrough, minimize scopes, and block private or reserved IP ranges before outbound requests.

Sources

OWASP Top 10 for LLM and GenAI Apps 2025 - Prompt injection, excessive agency, sensitive information disclosure, and vector/embedding weaknesses.
Model Context Protocol Security Best Practices - MCP SSRF, token passthrough, authorization, local server compromise, and scope minimization guidance.

Personalized Recommendations for Example AI Agent Platform

These actions are tailored to the target, authorization model, actual evidence sources, and the current finding set.

High 0-7 days

Put the fetch tool behind a shared URL policy gate before letting the agent planner choose destinations.

The example platform gives the model a network-capable action, so prompt injection can become SSRF unless policy enforcement happens outside the LLM.

Owner: Agent platform / MCP owner Findings: F-SSRF-001

Detailed Findings

F-SSRF-001 - sonar, manual-review

1. Agent web fetch tool can receive model-controlled URLs

High Confidence: high

Affected Component

agent web fetch tool

Affected File

src/tools/fetch_url.ts

Affected Endpoint

/api/agent/tools/fetch-url

Affected Asset

internal network reachable by agent runtime

Evidence

{
  "summary": "The fetch tool accepts an arbitrary URL from the agent planner without a deterministic host allowlist or private IP block.",
  "rule_id": "custom-ai-ssrf"
}

Attack Path

A prompt injection causes the model to call the fetch tool with an internal metadata or service URL. The tool performs the request from the trusted runtime.

AI / Agent Relevance

The LLM is not a trusted policy enforcement point. Prompt or RAG injection can influence tool parameters unless deterministic validation exists before network access.

Threat Intelligence

As of 2026-05-28

This finding maps to a common agentic exploit pattern: prompt injection or compromised context influences a network-capable tool, turning an AI workflow into an SSRF path.

Prompt injection to tool abuse: The vulnerable tool trusts model-selected URLs rather than a deterministic network policy. Action: Block private and link-local ranges after DNS resolution, require allowlists, and log denied attempts.

Mapped Techniques

{
  "mitre_atlas": "Prompt injection and tool abuse pattern",
  "cwe": "CWE-918"
}

Detection / Test Impact

Add a regression test that attempts metadata-service and RFC1918 URLs through the agent tool and asserts denial before outbound network access.

Sources

OWASP Top 10 for LLM and GenAI Apps 2025 - Prompt injection and excessive agency are directly relevant to model-influenced tool parameters.
Model Context Protocol Security Best Practices - MCP guidance highlights SSRF and least-privilege controls for tool-connected AI systems.
MITRE ATLAS - Use ATLAS to map AI-specific adversary behavior around prompt injection and tool abuse.

Freshness: Checked against official sources on 2026-05-28Confidence: High

Attack Path Visualization

How Prompt Influence Can Become Agent SSRF

The risk is not that the model is malicious by itself. The risk is that untrusted prompt or retrieved context can steer a network-capable tool unless deterministic URL policy checks happen outside the model.

1 Prompt Influence

Untrusted content influences the agent planner.

Actor: External user or poisoned contextGap: The prompt is treated as trusted instruction.Break: Classify external prompt and retrieved content as untrusted.

2 Tool Selection

The planner selects the web fetch tool with a model-controlled destination.

Actor: Agent runtimeGap: Tool parameters rely on model judgment.Break: Validate tool parameters before execution.

3 Network Boundary

The runtime attempts outbound access from a trusted network position.

Actor: Fetch toolGap: No allowlist or private IP block after DNS resolution.Break: Block private, reserved, and link-local ranges.

4 Impact

Internal services or metadata endpoints may become reachable through the agent.

Actor: Protected assetGap: Runtime egress is too broad.Break: Restrict egress and require approval for new domains.

5 Detect / Break

Denied URL attempts should be logged and covered by regression tests.

Actor: Security controlGap: No test proves the unsafe request is blocked.Break: Add CI tests and runtime detections for blocked destinations.

Attacker Goal

Cause the agent runtime to request an internal or otherwise unauthorized URL.

Preconditions

The attacker can influence prompt, chat, document, or workflow context that reaches the agent planner.

Control Breaks

Missing deterministic URL policy enforcement outside the LLM.

Impact

Internal network reachable by the agent runtime.

Detection Points

Denied requests to private, reserved, link-local, and metadata ranges.

Defensive Breakpoints

URL allowlist, DNS resolution checks, egress restriction, approvals, logging, and regression tests.

Conceptual exploit flow for authorized defensive review.

No payloads or unauthorized exploitation steps are provided.

Framework Mappings

{
  "owasp_llm": "LLM01 Prompt Injection; LLM06 Excessive Agency",
  "owasp_agentic": "Tool Misuse; Excessive Agency",
  "mitre_atlas": "Prompt Injection / Tool Abuse",
  "nist_ai_rmf": "Map, Measure, Manage",
  "cwe": "CWE-918",
  "cve": null
}

Score

{
  "system": "AIVSS",
  "value": "High",
  "rationale": "High autonomy, privileged network position, reproducible attack path, and weak deterministic control."
}

Recommended Fix

Add an outbound host allowlist, block private/link-local IP ranges after DNS resolution, require explicit approval for untrusted domains, and log denied attempts.

Regression Test

Add an integration test that attempts to fetch http://169.254.169.254 and internal RFC1918 ranges through the agent tool and asserts denial before any network request.

Residual Risk

Residual risk remains if newly added tools bypass the shared URL validation library.

Personalized Remediation Roadmap

ID	Severity	Finding	Recommended Fix
F-SSRF-001	High	Agent web fetch tool can receive model-controlled URLs	Add an outbound host allowlist, block private/link-local IP ranges after DNS resolution, require explicit approval for untrusted domains, and log denied attempts.

Regression Test Plan

ID	Test / Control
F-SSRF-001	Add an integration test that attempts to fetch http://169.254.169.254 and internal RFC1918 ranges through the agent tool and asserts denial before any network request.

Framework Coverage

ID	Framework	Mapping
F-SSRF-001	owasp_llm	LLM01 Prompt Injection; LLM06 Excessive Agency
F-SSRF-001	owasp_agentic	Tool Misuse; Excessive Agency
F-SSRF-001	mitre_atlas	Prompt Injection / Tool Abuse
F-SSRF-001	nist_ai_rmf	Map, Measure, Manage
F-SSRF-001	cwe	CWE-918

Residual Risk and Assumptions

Residual risk depends on complete remediation, regression test adoption, scanner coverage, evidence redaction, and continued enforcement of deterministic authorization around model-driven actions.