Adding an AI agent between a user and a backend changes the attacker’s interface but does not patch underlying authorization, injection or business-logic flaws. Researchers reproduced vulnerable effects through endpoint, workflow and query-oriented agent tools, with meaningful variation in both exploit rate and legitimate capability. This is a controlled…
Inspect the ClaimsCase · DiggingBeagle record
VELA shows agent-mediated web access does not eliminate backend vulnerabilities
Authors tested 44 reproducible flaws in 12 apps and found many attacks reachable through AI-mediated interfaces, with different tool interfaces exposing different capabilities.
MCP tool catalog restrictions can diverge from invocation authorizationLive authorization at the point of agent side effect
Scope
The benchmark uses 12 chosen applications and reproducible defects, not production exploitation prevalence.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The source is primary to the described analysis, not independent replication of every outcome. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-VELA-AGENT-BACKEND-EXPLOITS-A · The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation
At a glance
Agent tool wrappers cannot replace backend authentication, object-scope enforcement or transaction invariants.
Read the implicationsThe benchmark uses 12 chosen applications and reproducible defects, not production exploitation prevalence. The twelve selected applications, exposed tool variants and scripted attacker goals are not representative prevalence measurements for public MCP deployments.
Limits and uncertaintyFull account
Adding an AI agent between a user and a backend changes the attacker’s interface but does not patch underlying authorization, injection or business-logic flaws. Researchers reproduced vulnerable effects through endpoint, workflow and query-oriented agent tools, with meaningful variation in both exploit rate and legitimate capability. This is a controlled collection of known flaws, not an account of new live victims or a claim that every model is equally vulnerable.
In the VELA reference configuration the authors report that agent mediation preserves exploitability for roughly 91% of the forty-four selected known backend defects. Tool-interface restrictions reduce some attack paths by removing operations or input control, but may also disable legitimate tasks. Thus an agent that politely declines a command cannot substitute for server-side object authorization, and a tool schema that looks narrow is not proof that the underlying API enforces a corresponding scope. The experiment measures controlled exploitability retention rather than a count of actively exploited services.
Mechanism and trust boundary
- 01
Expose backend operations through agent tools
The AI interface advertises service capabilities to a tool-using model.
Boundary: Application API into model-selectable tools
- 02
Specify an adversarial goal
The model or orchestrator composes calls that reach an already vulnerable backend path.
Boundary: Language instruction into service action
- 03
Backend fails independently
The original vulnerable permission or data invariant can still be violated.
Boundary: Model mediation into unchanged backend trust boundary
Claims & evidence
CLM-2026-NOV02-VELA-AGENT-BACKEND-EXPLOITS-AThe VELA study tests 44 known web application flaws and reports that forty were realizable in a scripted baseline; coding agents could exercise all forty at least once in the evaluated conditions.supported
Basis: reported finding
- supportsThe Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitationprimary disclosure
Abstract, experiment design and interface comparison
CLM-2026-NOV02-VELA-AGENT-BACKEND-EXPLOITS-BThe VELA authors report that 91 percent of 44 selected backend vulnerabilities remained exploitable through a reference AI-mediated interface in their controlled benchmark.supported
Basis: reported finding
- supportsThe Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitationprimary disclosure
Abstract, reference interface exploitability and legitimate workflow tradeoff
Implications
Agent tool wrappers cannot replace backend authentication, object-scope enforcement or transaction invariants.
Controls and mitigations
- Test actual effects under least-privileged accounts and compare legitimate utility alongside exploit success, with independent server-side checks.
- Check authorization and state invariants at the backend with real constrained test accounts; measure both blocked exploit paths and legitimate tasks lost to interface restrictions.
Unknowns and contradictions
- The benchmark uses 12 chosen applications and reproducible defects, not production exploitation prevalence.
- The twelve selected applications, exposed tool variants and scripted attacker goals are not representative prevalence measurements for public MCP deployments.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214