Connecting an AI assistant to files, code, and business tools makes it useful—and creates a path an attacker can target without compromising the model itself. JFrog researchers have demonstrated that a weakness in one implementation of Model Context Protocol can let a malicious party impersonate a legitimate session and alter what an assistant tells its user.
The flaw, CVE-2025-6515, affects the MCP implementation in the Oat++ C++ framework when HTTP Server-Sent Events are enabled on a reachable network. It turns a familiar web-security failure, session hijacking, into a new kind of AI manipulation.
An attacker could make an assistant recommend a malicious software package, inject harmful code, expose data, or trigger commands while the response appears to belong inside the user’s trusted workflow. The assistant’s familiar interface may make that interference especially difficult for a developer to recognise and stop in time.
The Attack Targets the Connection, Not the Model
Models do not automatically know which file a developer has open or what a company database contains. Anthropic created MCP as a standard way for assistants to connect with local information and online services. The protocol supplies the context and tools that turn a general model into a practical work assistant.
JFrog’s example begins with an ordinary request: recommend a standard Python library for image processing. A legitimate response might suggest Pillow. After hijacking the session, an attacker could substitute a fabricated package such as “theBestImageProcessingPackage,” turning helpful guidance into a software supply-chain attack.
The model has not been retrained or directly breached. The communication around it has been manipulated. This distinction matters because security reviews focused only on prompts and model behaviour can miss weaknesses in the middleware carrying requests and responses.
Predictable Session IDs Break User Separation
When a client connects through Server-Sent Events, the affected server creates a session identifier. The Oat++ implementation used the session object’s memory address for that ID instead of generating a unique, cryptographically secure value.
Computers reuse memory addresses. An attacker can repeatedly open and close sessions, collecting identifiers that may later be assigned to a real user. Once a recycled value becomes valid, malicious requests carrying that ID look legitimate to the server, which cannot distinguish the attacker from the user.
Some clients accept only responses with expected event identifiers, but JFrog found that attackers may spray many messages using common values until one passes the check. The result is a collision between two sessions that should have remained isolated.
AI Infrastructure Needs Familiar Security Discipline
The immediate remedy is secure session management. Servers must create identifiers with strong random generators, expire them appropriately, and never derive them from predictable implementation details. Clients should reject events that do not match expected types and unpredictable identifiers.
Zero-trust principles should extend across the entire AI system. Security teams need to examine the model, MCP servers, client applications, middleware, tools, and networks as one connected attack surface. Access to a model does not imply permission to every resource an attached tool can reach.
This particular vulnerability belongs to one implementation, but the underlying lesson is general. As protocols grant assistants access to more sensitive context and more powerful actions, failures in authentication and session separation gain greater consequences.
MCP did not invent session hijacking. It placed an old weakness inside a workflow where a trusted assistant can recommend dependencies, edit code, retrieve documents, and execute tools. Securing agentic AI therefore requires more than filtering hostile text. It requires applying proven application-security controls to every channel through which the model sees and acts, with the same rigour expected from other privileged business software.
