AI Agent Ecosystems — From Model Manipulation to Operational Hijacking (CVE-2025-32711, CVE-2025-54135)

Publication date: September 21, 2026
Category: Threat Intelligence / AI Security (LLM/LocalAI)

Introduction

Recent artificial intelligence security research marks a fundamental turning point: the cybersecurity community has shifted its primary focus away from the static behavior of language models toward examining real attack paths through autonomous agents, connected skills, communication protocols, and integrated environments. When mapping this evolving landscape onto the MITRE ATLAS matrix, a complete kill chain emerges where the objective is no longer merely making a chatbot output forbidden text, but compromising an agent capable of taking autonomous action on underlying systems. This report examines the taxonomy of these threats, highlighting critical vulnerabilities such as EchoLeak (CVE-2025-32711) and CurXecute (CVE-2025-54135), and outlines the urgent need to adapt Blue Team defensive strategies.

What is AI Agent Hijacking and Its Attack Surface? (General Analysis)

Traditionally, AI security was evaluated through the lens of restricting text output via alignment filters. However, the mass adoption of AI agents—systems endowed with persistent memory, access to external APIs, and the capability to execute commands or manipulate filesystems—has dramatically expanded the attack surface.

An agent does not operate in a vacuum; it interacts with an ecosystem comprised of:

  • Skill and Tool Supply Chains: Repositories and marketplaces where developers download third-party plugins.
  • Model Context Protocols (MCP): Standards allowing AI to connect to external databases, development environments, and corporate APIs.
  • Execution Capabilities (“Hands”): Permissions to send emails, modify local files, or execute terminal commands.

In this context, vulnerabilities transcend logical anomalies to become access control failures and remote code execution flaws. Two official vulnerabilities analyzed during this period stand out:

  • CVE-2025-32711 (EchoLeak): An AI command injection flaw in M365 Copilot that allows an unauthorized attacker to exfiltrate information over a network (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N — Score: 9.3 Critical, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). Confirmed by NVD data.
  • CVE-2025-54135 (CurXecute): A vulnerability in the Cursor code editor (versions prior to 1.3.9) allowing in-workspace file writing without user approval. When chained with indirect prompt injection, it enables attackers to manipulate Model Context Protocol settings (.cursor/mcp.json) to trigger Remote Code Execution (RCE) (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H — Score: 8.5 High, CWE-78 and CWE-829: Improper Neutralization of Special Elements used in an OS Command / Inclusion of Functionality from Untrusted Control Sphere). Confirmed by NVD data.

How Does It Work? (Technical Analysis)

The research maps malicious activity against the MITRE ATLAS matrix, establishing a comprehensive kill chain that operates across several stages:

  • Large-Scale Reconnaissance (AML.T0014): Attackers leverage agent-based automated pipelines to conduct large-scale deanonymization, extracting identity signals from public text fragments and correlating them to build detailed profiles of human targets, challenging practical anonymity.
  • Tool Poisoning & Supply Chain (AML.T0110 / AML.T0011.002): Static analysis and sandbox execution of skill marketplaces revealed malicious dependencies functioning as data stealers or agent hijackers. These components hide malicious behavior inside documentation, mimicking legitimate packages installed by users.
  • Direct and Indirect Prompt Injection (AML.T0051): Advanced techniques —such as reinforcement learning-driven automated discovery of injection strings and adaptive red-teaming frameworks— enable attackers to manipulate agent behavior while preserving a legitimate appearance, as demonstrated by zero-click vectors like CVE-2025-32711.
  • Structural Evasion and Jailbreaks (AML.T0054): Research shows that defenses concentrated in isolated components (such as specific filters or expert nodes in Mixture-of-Experts models) can be structurally bypassed via context prefill attacks or targeted node silencing.
  • Execution, Impact, and Cross-Agent Propagation (AML.T0086): In autonomous environments with shell and filesystem access, compromised agents can execute destructive actions, exfiltrate data, or propagate malicious behavior across other agents via shared memory and conversations, acting analogously to a network worm.

Affected Systems / Environments

The analyzed vectors impact a broad range of AI implementations and developer tools:

  • Enterprise assistance environments powered by Microsoft 365 Copilot (impacted by CVE-2025-32711).
  • AI-assisted programming environments and Model Context Protocol editors, specifically Cursor versions below 1.3.9 (CVE-2025-54135).
  • Third-party skill marketplaces for autonomous assistants.
  • Open-weight language models vulnerable to context state manipulation and structural jailbreaks.
CVECategory (CWE)ImpactCVSSVector (Condensed)
CVE-2025-32711CWE-74 (Injection)Information Disclosure / Critical9.3AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVE-2025-54135CWE-78, CWE-829Remote Code Execution (RCE) / High8.5AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Immediate Patching: Update the Cursor code editor to version 1.3.9 or higher to mitigate CVE-2025-54135. Apply official vendor updates for Microsoft 365 Copilot regarding CVE-2025-32711.
  • Inventory and Census: Maintain a strict inventory of all deployed agents, installed extensions, and connected MCP servers within the organization.
  • AI Supply Chain Discipline: Treat agent skills and tools as critical software dependencies. Implement static analysis, sandbox execution, and version pinning.

Detection

  • Behavioral Drift Monitoring: Audit tool calls and function invocations made by agents, watching for anomalous file access patterns or network exfiltration attempts.
  • Runtime Telemetry: Capture detailed logs of prompt contexts, state variables, and Model Context Protocol transactions.

“The critical security battleground no longer resides solely in model output alignment, but in rigorous runtime telemetry and monitoring of the actions agents execute on underlying systems.”

Wrapping Up

The artificial intelligence cybersecurity landscape has matured into a phase where the primary attack vector is the autonomous agent and its interconnected ecosystem. Vulnerabilities such as CVE-2025-32711 and CVE-2025-54135 demonstrate that the gap between theoretical research and critical real-world exploitation is measured in weeks. To counter these threats, organizations must enforce rigorous inventory disciplines, secure the AI skill supply chain, and pivot their monitoring from model words to tool actions.

References