Skip to content

Hiding in the AI Traffic: Abusing MCP for LLM-Powered Agentic Red Teaming

🕒 Published (v1): 2025-11-20 02:51 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This paper proposes a novel command & control (C2) architecture that abuses the Model Context Protocol (MCP) to coordinate distributed autonomous red team agents across networks with stealth. The system decouples agent tasking (via MCP) from agent reasoning (via public LLM APIs), routing malicious intent through trusted AI traffic. Built on top of RedTeamLLM, it achieved domain compromise on a corporate network in under an hour with no human intervention.

Problem

Existing AI red teaming frameworks cluster around early Cyber Kill Chain phases (recon, exploitation) and rely on traditional C2 channels with predictable network signatures (e.g., periodic beaconing). They also face generality-vs-specialization trade-offs, context window limitations, hallucinations, and human-in-the-loop bottlenecks. The later, persistent C2 and long-term orchestration phases remain underaddressed.

Method

The architecture introduces a two-leg communication design: 1. Tasking channel: wraps operator instructions inside legitimate-looking MCP traffic to a cloud MCP server, blending with enterprise AI service calls. 2. Reasoning channel: each agent calls public LLM APIs (e.g., Anthropic) directly for planning and payload generation, laundering malicious reasoning as high-reputation encrypted traffic to a trusted vendor.

A central AI command agent orchestrates distributed sub-agents via the MCP server asynchronously, enabling parallel operations across segregated network segments without beaconing. The "Red Team Agent" is built by heavily modifying RedTeamLLM (>18,500 lines of new code), adding: (a) the decoupled MCP C2 layer, (b) a persistent SQLite-based memory for cross-session and cross-agent state, and (c) a hybrid planning system combining reactive (ReAct) and deliberative planning with on-the-fly plan correction. Detection evasion is achieved by adapting tactics in real time based on EDR feedback.

Key Contributions

  • Two-leg decoupled C2 architecture using MCP as a covert, vendor-agnostic tasking channel that hides in legitimate AI traffic
  • Elimination of classic C2 detection artifacts (no beaconing; traffic indistinguishable from normal ML API calls)
  • Persistent SQLite memory enabling long-horizon context sharing across distributed agents
  • Hybrid planning system with real-time plan correction integrated into the RedTeamLLM base
  • Comprehensive survey of state-of-the-art GenAI red teaming frameworks mapped to the Cyber Kill Chain
  • Case study demonstrating domain compromise in <1 hour with EDR evasion
  • Proposed defensive countermeasures and ethical analysis of dual-use implications

Results

  • Domain compromise on a simulated corporate network in under 1 hour with zero human intervention
  • Full EDR evasion through on-the-fly tactic adaptation
  • Qualitative comparison with traditional C2 shows "drastic reductions in manual effort and detection footprint" (no quantified percentages provided in the available text)
  • The decoupled architecture eliminates host and network artifacts previously usable for C2 detection

Limitations

  • Quantitative experimental comparisons are described but specific metrics (detection rates, false-positive rates, time-to-compromise distributions) are not fully reported in the available text
  • Evaluation is conducted on a simulated/lab corporate network, not a real enterprise environment — the CTF-to-enterprise gap the authors themselves identify applies here
  • Relies on availability and permissiveness of public LLM APIs for the reasoning channel; policy changes by providers could break operation
  • The hybrid planner and plan-correction components are described as an advancement over RedTeamLLM's stateless summarizer, but no ablation isolates their individual contributions
  • Ethical safeguards and controlled deployment prerequisites are acknowledged but depend on institutional enforcement

Relevance to Harnesses / Meta-Harnesses

This paper is directly relevant as an operational multi-agent meta-harness: the MCP server functions as a central orchestrator dispatching tasks to heterogeneous sub-agents, each independently reasoning via external LLM APIs — a classic meta-harness topology where the coordinator is decoupled from the executors. The addition of a persistent shared memory (SQLite) and a hybrid planning layer with real-time correction exemplifies how harness designs must solve state management and error recovery across agent boundaries. The paper also serves as a structured survey of prior agentic frameworks (RedTeamLLM, PentestAgent, VulnBot, PENTESTGPT), making it a useful reference for understanding how harness design choices (stateless vs. stateful memory, monolithic vs. modular planning, human-in-loop vs. fully autonomous) affect real-world task performance.