Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms
This study compares Function Calling and Model Context Protocol architectures in LLM agents, revealing architecture significantly influences attack success rates, with chained attacks reaching 91-96%.
Key Findings
Methodology
Using a unified threat classification framework, over 3,250 attack scenarios were simulated across seven language models. The evaluation included simple, composite, and chained attacks targeting AI-specific threats like prompt injection and traditional software vulnerabilities such as JSON injection and DoS. The approach incorporated multi-stage attack models, threat taxonomy, and multi-metric analysis (attack success rate and refusal rate). Results were validated through extensive empirical testing, enabling a comprehensive understanding of how architecture influences vulnerability profiles and attack pathways.
Key Results
- Function Calling architecture achieved an overall attack success rate of 73.5%, notably higher than the 62.59% of MCP, indicating greater system-centric vulnerability. Chain attacks, involving multiple steps, reached success rates of 91-96%, demonstrating how attack complexity amplifies exploitability. Surprisingly, models with advanced reasoning capabilities, despite better threat detection, showed higher susceptibility, highlighting a paradox in model robustness. The experiments confirmed that complex attack chains significantly increase breach likelihood, emphasizing architecture's critical role in security posture.
- Analysis of attack interactions revealed that composite attacks combining prompt injection and JSON injection substantially increased success rates. The internal reasoning modules, while enhancing model intelligence, also created new attack vectors. The results underscore that architectural choices shape the threat landscape, with trade-offs between containment and vulnerability exposure. These insights provide a foundation for designing more resilient LLM-based systems, balancing performance and security.
- Overall, the research demonstrates that architectural design decisions directly impact vulnerability profiles, with implications for deploying secure AI agents in real-world environments. The findings advocate for integrated security considerations during system development, emphasizing multi-layer defenses and threat-aware architecture optimization.
Significance
This research addresses a critical gap in AI security by systematically comparing how different deployment architectures influence vulnerability profiles. It offers a novel, comprehensive framework for cross-domain threat assessment, integrating AI-specific threats with traditional software vulnerabilities. The insights gained inform both academia and industry, guiding the development of more secure, robust LLM-based agents. The study’s emphasis on complex, multi-stage attack modeling advances understanding of real-world breach scenarios, highlighting the importance of architecture-aware security design. Its implications extend to sectors like healthcare, finance, and customer service, where AI agents operate in high-stakes environments, underscoring the need for resilient system architectures that can withstand sophisticated cyber threats.
Technical Contribution
The paper introduces a formal multi-stage attack framework combining threat taxonomy, attack surface analysis, and progression modeling, tailored for LLM agent architectures. It innovates by quantifying how architecture influences attack pathways, especially in chained and composite scenarios. The methodology integrates empirical attack success metrics with theoretical models, providing a rigorous basis for security evaluation. The comparative analysis between Function Calling and MCP offers new insights into architectural vulnerabilities, emphasizing the importance of design choices in security hardening. This work bridges the gap between AI and software security, establishing a foundation for future integrated defense strategies.
Novelty
This is the first comprehensive comparison of Function Calling and Model Context Protocol architectures under multi-stage, multi-vector attack scenarios. It uniquely combines empirical simulation with formal attack progression models, revealing how architectural differences fundamentally alter threat landscapes. Unlike prior work focusing solely on AI vulnerabilities or isolated software flaws, this study emphasizes the interplay between system design and security, introducing a novel multi-layered attack framework that captures real-world breach complexities.
Limitations
- The experiments rely on simulated attack scenarios, which may not fully capture the complexity of real-world environments. Variations in deployment context, hardware, and network conditions could influence attack effectiveness. Further validation in operational settings is needed.
- While the study highlights the paradox of advanced reasoning models being more exploitable, it does not fully explore mitigation strategies that balance reasoning power and security, leaving room for future research.
- The analysis primarily focuses on two architectures; other emerging paradigms like multi-agent systems or federated learning remain to be evaluated for comprehensive security assessment.
Future Work
Future research will extend the framework to include adaptive defense mechanisms, real-world deployment testing, and automated threat detection. Exploring multi-model collaborations and federated architectures could reveal new vulnerabilities and defense strategies. Additionally, integrating dynamic threat monitoring and response systems will enhance resilience. The goal is to develop standardized, scalable security protocols adaptable across diverse AI deployment scenarios, ensuring safer integration of LLM agents in critical sectors.
AI Executive Summary
The rapid adoption of large language models (LLMs) as autonomous agents has revolutionized AI applications across industries such as healthcare, finance, and customer service. These agents, capable of complex decision-making and interaction, introduce new security challenges that span both AI-specific threats like prompt injection and traditional software vulnerabilities like JSON injection and denial-of-service attacks.
Existing research has largely treated these threats separately, focusing either on AI vulnerabilities or on classical software flaws. However, the architecture of LLM-based agents plays a crucial role in shaping their security posture. This study compares two prominent deployment paradigms: Function Calling and Model Context Protocol (MCP). Using a comprehensive threat modeling framework, over 3,250 attack scenarios were simulated across seven different language models, covering simple, composite, and chained attack vectors.
Results reveal that Function Calling architecture exhibits a higher overall attack success rate (73.5%) compared to MCP (62.59%), indicating greater system-centric vulnerabilities. Chain attacks, which involve multiple steps and exploit interconnected vulnerabilities, achieved success rates as high as 91-96%, underscoring the importance of attack complexity. Interestingly, models with superior reasoning capabilities, despite better threat detection, proved more vulnerable to exploitation, highlighting a paradox in AI robustness.
These findings emphasize that architectural choices are fundamental in determining security risks. They suggest that designing resilient systems requires balancing performance with multi-layered defenses tailored to specific deployment paradigms. The research provides a methodological foundation for cross-domain security assessment, guiding industry practitioners in deploying safer AI agents.
Looking ahead, future work will focus on integrating dynamic threat detection, automated security protocols, and broader architectural evaluations, aiming to build more robust, attack-resilient AI systems capable of operating securely in real-world environments.
Deep Dive
Abstract
Large Language Model (LLM) agents face security vulnerabilities spanning AI-specific and traditional software domains, yet current research addresses these separately. This study bridges this gap through comparative evaluation of Function Calling architecture and Model Context Protocol (MCP) deployment paradigms using a unified threat classification framework. We tested 3,250 attack scenarios across seven language models, evaluating simple, composed, and chained attacks targeting both AI-specific threats (prompt injection) and software vulnerabilities (JSON injection, denial-of-service). Function Calling showed higher overall attack success rates (73.5% vs 62.59% for MCP), with greater system-centric vulnerability while MCP exhibited increased LLM-centric exposure. Attack complexity dramatically amplified effectiveness, with chained attacks achieving 91-96% success rates. Counterintuitively, advanced reasoning models demonstrated higher exploitability despite better threat detection. Results demonstrate that architectural choices fundamentally reshape threat landscapes. This work establishes methodological foundations for cross-domain LLM agent security assessment and provides evidence-based guidance for secure deployment. Code and experimental materials are available at https: // github. com/ theconsciouslab-ai/llm-agent-security.