"Living Off the AI": Attackers Abuse AI Agents, MCP Connectors, and Vibe-Coding Platforms for Offensive Ops — Threadlinqs Intelligence
As of 2026-02-06, "Living Off the AI": Attackers Abuse AI Agents, MCP Connectors, and Vibe-Coding Platforms for Offensive Ops is a medium-severity threat intel threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1635 · Severity: MEDIUM · Status: ACTIVE · Category: THREAT_INTEL
Security researchers document an emerging attacker tradecraft pattern -- "living off the AI" -- in which adversaries piggyback on sanctioned AI assistant, agent, and Model Context Protocol (MCP)
In a February 2026 analysis, Etay Maor (VP of Threat Intelligence, Cato Networks) frames "living off the AI" as the AI-era successor to living-off-the-land (LotL) tradecraft: rather than deploying custom malware, attackers abuse the same sanctioned AI assistants, agents, and Model Context Protocol (MCP) connectors that organizations have deployed for productivity. Four converging technique classes are documented. First, prompt-born tool abuse: hidden instructions embedded in documents or webpages an agent ingests cause it to invoke connected tools -- querying internal RAG indexes for secrets, scheduling tasks, or exfiltrating data -- without tripping traditional EDR, because the actions are performed by an already-trusted agent identity. Second, MCP and agent "tooljacking": over-permissioned tool chains (unrestricted filesystem mounts, full-tenant search, unbounded web fetch) let an attacker nudge an agent into chaining tools in ways never intended by the integration's designer. This is closely related to the independently-documented "MCP Tool Poisoning" primitive, in which a malicious or compromised MCP server returns tool responses containing hidden natural-language instructions that land directly in the LLM's context and are treated as trusted input -- exploiting a structural trust gap between one-time, connect-time tool-description review and unvalidated, per-call tool-response content. Third, memory and retrieval poisoning: malicious "facts" seeded into shared vector stores or prior chat histories persist and reshape future agent behavior, suppressing warnings or inserting attacker-controlled exfiltration endpoints; this class has since been formalized industry-wide as OWASP Agentic AI Top 10 category ASI06 (Memory and Context Poisoning), and academic red-team work (AgentPoison, MINJA, PoisonedRAG, MemoryGraft) demonstrates greater than 80-95% attack success rates against RAG-based agents from small numbers of poisoned documents or query-only interactions, requiring no model retraining. Fourth, "cloud camouflage": attackers route agent-mediated communications through popular, allow-listed SaaS platforms so the AI itself becomes the dispatcher for collaboration posts, ticket updates, or "summaries" that carry sensitive data past egress controls tuned for classic C2 traffic. As a real-world proof of concept, the source article's author built a functioning Chrome credential-stealing capability using AI-driven "vibe coding" platforms (Lovable, Base44, Netlify, Vercel) via an "immersive world" context-manipulation technique -- no manual code was written, illustrating what the author calls a "zero-knowledge threat actor": minimal technical expertise is now needed to assemble offensive capability once an AI agent provides code generation, execution, file-system access, and knowledge-base integration on the attacker's behalf. This tradecraft is corroborated by two independent, contemporaneous disclosures cited in follow-on research: (1) Wiz Research's July 2025 discovery of a critical authentication-bypass flaw in the vibe-coding platform Base44 (subsequently acquired by Wix), in which providing only the non-secret app_id to undocumented registration/OTP-verification endpoints let an attacker fully bypass SSO and app-level auth to access private enterprise apps built on the platform -- patched within 24 hours, no confirmed in-the-wild exploitation; and (2) OX Security's April-May 2026 "Mother of All AI Supply Chains" research, an architectural "RCE-by-design" flaw baked into Anthropic's official MCP SDKs across Python, TypeScript, Java, and Rust, rippling through 150M+ downloads and up to ~200,000 exposed MCP server instances, with verified zero-click prompt-injection-to-RCE chains demonstrated against the Cursor and Windsurf AI coding IDEs and downstream impact confirmed in LangChain, LiteLLM, and IBM LangFlow. Together these findings show the MCP/agent ecosystem's trust model -- connect-once tool vetting, implicit trust of tool
Weaknesses (CWE)
CWE-287, CWE-306, CWE-20, CWE-829
Target sectors: technology, finance, enterprise-saas, government administration, health
Target regions: Global
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, MEDIUM, threat intelligence, cybersecurity, T1592, T1583.006, T1585.003, T1588.002, T1195.002, T1566.002, T1189, T1190, T1199, T1203
