Web3 AI Agent Security Survey: Irreversible Attack Risks in MCP Ecosystems
An arXiv preprint (2608.17275) examines security risks when AI agents perform actions on Web3 blockchains through the Model Context Protocol. Tool use that changes external states has grown from 27% to 65% in the MCP ecosystem. The authors argue that blockchain execution properties—irreversibility, signing authority, continuous autonomy, and sequence-level composition—turn ordinary agent failures into permanent losses. They map the fragmented security literature into an attack-surface taxonomy and provide a risk matrix linking each attack class to its amplified impact, responsible amplifiers, and mitigations. The paper is cross-listed and highlights the need for new security assumptions beyond conventional software.
Key facts
- The share of deployed tools that modify external state in the MCP ecosystem rose from 27% to 65% of tool use.
- The survey covers MCP, skills, and tool calling for AI agents acting on public blockchains.
- Attack consequences are governed by the blockchain execution layer, not conventional software assumptions.
- Four properties of the blockchain execution layer are identified: irreversibility, signing authority, continuous autonomy, and sequence-level composition.
- These properties qualitatively change the threat model, turning recoverable failures into standing, irreversible losses.
- The paper organizes the fragmented MCP-security literature into an attack-surface taxonomy.
- The paper contributes a Web3 risk-mapping matrix that ties each attack class to amplified impact, responsible amplifiers, a representative mitigation, and residual risk.
- The preprint is listed as arXiv:2608.17275v1 with announce type 'cross'.
Entities
—