THE AI AGENT KILL CHAIN
7-Stage Attack Sequence for MCP Servers
The AI agent kill chain is a 7-stage attack sequence that exploits MCP servers and AI coding agents to steal developer credentials. Attackers combine AI-generated phishing, supply chain poisoning, and MCP configuration hijacking to compromise development environments. OpenSyber documents the controls available for supported integrations; coverage depends on the configured deployment.
What is the AI agent kill chain?
The AI agent kill chain is a structured attack model describing how threat actors compromise AI coding agents like Cursor, GitHub Copilot, and Claude Code. It follows 7 sequential stages: AI-powered phishing, credential theft, malicious package publication, agent-side installation, CLI hijacking via MCP, filesystem enumeration, and credential exfiltration. Each stage builds on the previous one, and blocking any single stage breaks the chain.
How does each stage work?
Stage 1: AI-Powered Phishing
Attack: Attacker uses GPT-4-class models to generate targeted phishing emails impersonating npm, PyPI, or GitHub. LLM-generated messages can be grammatically polished and context-aware, making link reputation and credential-flow controls important.
Detection: OpenSyber monitors inbound link reputation where the supported integration is enabled; response time depends on the deployment and signal.
Stage 2: npm Credentials Stolen
Attack: The developer clicks a phishing link and enters their npm token on a cloned login page. Attackers now control publishing rights to packages the developer maintains.
Detection: Not covered by the current documented scope; additional credential-leak integrations would be required.
Stage 3: Malicious Package Published
Attack: Attacker publishes a trojanized patch version (e.g., bumping 2.3.1 to 2.3.2) containing an obfuscated postinstall script. Automated patch updates can spread a compromised package quickly.
Detection: OpenSyber can govern configured package and tool workflows where the integration is enabled, with policy and evidence scope defined by the deployment.
Stage 4: Developer Installs via Agent
Attack: An AI coding agent like Cursor, Copilot, or Claude Code runs npm install as part of a task. The agent has no mechanism to distinguish legitimate packages from compromised ones.
Detection: OpenSyber can govern configured package-install workflows where the integration is enabled, with policy and evidence scope defined by the deployment.
Stage 5: AI CLI Hijacked
Attack: The malicious postinstall script modifies the agent's MCP configuration, injecting a rogue tool server that intercepts all subsequent commands. The agent now routes requests through attacker infrastructure.
Detection: OpenSyber can surface MCP configuration changes where the supported runtime monitor is enabled; response and rollback behavior depend on the configured deployment.
Stage 6: Filesystem Enumerated
Attack: The rogue MCP server instructs the agent to list .env files, SSH keys, AWS credentials, and database connection strings. The agent complies because it has full filesystem access.
Detection: OpenSyber enforces deny-by-default file access policies. Agents can only read files within explicitly allowed directories. Any attempt to access .env, .ssh, or credential files triggers an immediate block and alert.
Stage 7: Credentials Exfiltrated
Attack: Stolen credentials are sent to attacker-controlled endpoints via DNS tunneling or HTTPS POST to domains that mimic legitimate analytics services.
Detection: Not covered by the current documented scope; additional DNS and egress integrations would be required.
How does OpenSyber detect kill chain attacks?
OpenSyber documents controls for selected kill-chain stages, including configured supply-chain checks, MCP configuration monitoring, and deny-by-default filesystem policies. Coverage, response behavior, alert routing, and evidence retention depend on the enabled integrations and deployment configuration.
Protect your agents from kill chain attacks.
Deploy a governed AI-assisted engineering workflow with runtime monitoring and evidence.