Otto Support – An MCP, Agentic-AI Security Challenge

2026-04-23 · Source: Bishop Fox - Bishopfox.com · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Advanced, medium

Summary

Bishop Fox released "otto-support", a capture-the-flag (CTF) challenge simulating real-world AI agent attack surfaces. This vulnerable Model Context Protocol (MCP) server, packaged as a customer support tool, connects to AI assistants like Claude Code. It features a single Go binary running in a container, a tiered authentication system, internal services, a ticket database, and 19 tools spread across four privilege levels. The CTF challenges participants to escalate access, exfiltrate data, and execute code by exploiting MCP tool interactions and web application vulnerabilities. It targets security engineers, red teamers, and developers working with AI agents and MCP-based systems, emphasizing the importance of source code analysis.

Key takeaway

For AI Security Engineers and Red Teamers assessing AI agent deployments, recognize that MCP-based systems introduce complex attack surfaces blending application security, identity, and local system exposure. You must prioritize isolated execution environments, least privilege, and vetted tool ecosystems to contain risks from AI agents interacting with local resources and internal services. This proactive approach is crucial to prevent data exfiltration and unauthorized code execution.

Key insights

Model Context Protocol (MCP) systems significantly expand AI agent attack surfaces by enabling interaction with local resources and internal services.

Principles

• AI agents with MCP can execute actions in real environments with inherited access.
• Local environments become a critical part of the AI agent attack surface.
• Risk extends beyond input validation to AI-generated decisions triggering real-world actions.

Method

The "otto-support" CTF demonstrates combining dynamic testing with source code analysis to validate vulnerabilities in generative AI business solutions.

In practice

• Identify and exploit privilege escalation paths through tool discovery.
• Manipulate AI assistants into performing unsafe or unintended actions.
• Exfiltrate data across trust boundaries using MCP tools.

Topics

• Model Context Protocol
• AI Agent Security
• Capture The Flag
• Privilege Escalation
• Prompt Injection
• Container Security

Code references

• BishopFox/otto-support
• BishopFox/o
• modelcontextprotocol/inspector

Best for: AI Architect, CTO, VP of Engineering/Data, AI Security Engineer, AI Engineer

Related on AIssential

• Your developers are already running MCP servers you don’t know about — Ungoverned Model Context Protocol (MCP) servers create security and compliance risks, demanding proactive governance.
• Build AI Security Agents with Wiz MCP — Wiz MCP integrates AI agents with security context and predefined skills to automate complex security workflows.
• Using MCP Agents for Penetration Testing — AI agents leveraging Model Context Protocol (MCP) can drastically accelerate and expand penetration testing coverage.
• Top 10 Security Risks in AI Agents Explained — AI agents are autonomous models using tools in a loop, posing unique security vulnerabilities.
• Designing Safe Database Access for AI Agents using MCP — Secure AI agent database access requires an MCP server to provide domain-level tools, not direct SQL.
• MCP Security Best Practices: What Every Enterprise Team Needs to Know in 2026 — MCP's power to call real tools necessitates robust security beyond traditional API practices to prevent breaches.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Bishop Fox - Bishopfox.com.