Toxic Flows in MCP Servers and Skills: What Your Agent Blindly Trusts

AI agents don’t just trust MCP servers. They trust Skills too. Both are attack surfaces, yet most teams treat neither as part of the same trust model.

In this talk, we introduce toxic flows: trust paths through an agent stack where tool descriptions, MCP responses, and Skill definitions can leak sensitive context, manipulate agent decisions, and trigger unintended actions without the model violating a single instruction. We demonstrate this live.

This session is not about adding authentication or wrapping everything in TLS. It’s about understanding how trust failures emerge, how they mirror familiar software risks like dependency confusion and unsafe deserialization, and how to design MCP servers and Skill integrations that reduce trust, contain blast radius, and keep agent systems defensible.

Attendees will leave with a practical framework for identifying trust boundaries, evaluating agent integrations, and hardening their AI stack against toxic flows.