/
← Voltar ao feed
low technology cloud services telecommunications

F5 Labs 2026 predictions: MCP attack surface, ID-verification breaches, agentic bots, ClickFix and AI overreliance

1 fonte(s) · 1 atualização(ões) · publicado 15/12/2025 16:00 · coletado há 1 dia

F5 Labs published its 2026 cybersecurity predictions and scored its 2025 forecasts at 6.5/8, by its own assessment. The 2025 review cites AI-powered botnets, attacks on AI model APIs, AI side-channel attacks on cryptography, APT use of hacktivist personas, and expanded Roskomnadzor powers to isolate or reroute Russian internet traffic from March 2026. For 2026, F5 expects Model Context Protocol (MCP) to become the universal connector for AI agents and to expand the attack surface. It also expects third-party ID-verification networks to become prime breach targets, bot defense to shift from proving humanity to judging intent, and quantum hype to reach a credibility checkpoint. Overreliance on AI outputs and continued ClickFix social engineering round out the list. This is forward-looking analysis, not a report of a specific incident.

Technical Details

  • MCP: servers will accumulate OAuth tokens, filesystem reach and workflow privileges. F5 cites 2025 faults including RCE in poorly isolated tool runners, authentication bypass in capability discovery, tool poisoning and prompt-driven data exfiltration. It also cites the "lethal trifecta" as hard to mitigate.
  • ID verification: centralized hubs holding passports, licenses and face videos become high-value targets. F5 predicts "re-verify" ClickFix lures, replay of old proofs, misconfigured storage, over-permissive client keys, deepfake pressure on liveness checks, and a black market for pre-verified personas.
  • Agentic bots: delegated sessions will carry real user tokens, so defenders must assess session motive through sequences, cadence and semantics rather than identity alone.
  • Quantum: the near-term risk is implementation drag and AI-assisted side-channel analysis (timing leaks, cache behavior, brittle hybrid fallbacks), not sudden cryptographic collapse. "Harvest now, decrypt later" remains a concern.
  • AI overreliance: cascading automated decisions and AI supply chain risks such as model poisoning.
  • ClickFix: fake CAPTCHAs and liveness checks, and pre-filled scripts disguised as repair commands, shared in chat and collaboration tools.

Remediation

  • Treat AI agent behavior as trackable and constrainable: signed capability manifests, scanning of MCP components and agent-to-tool-to-data telemetry.
  • Use purpose-bound sessions with scoped grants for delegated agents.
  • Adopt zero-retention and privacy-preserving identity models.
  • Build crypto agility and run post-quantum pilots.
  • Add autonomy reviews and policy tripwires outside model judgement, and track provenance of models and data.
  • Update awareness training from "don't click links" to "don't copy commands blindly", and detect repeated paste actions and sudden privilege escalations.

Linha do tempo

  1. f5.com ↗ · pub. 15/12/2025 16:00 · coletado 19/10 18:02 primeiro registro

    F5 Labs 2026 predictions: MCP attack surface, ID-verification breaches, agentic bots, ClickFix and AI overreliance

    ler a análise desta fonte

    F5 Labs published its 2026 cybersecurity predictions and scored its 2025 forecasts at 6.5/8, by its own assessment. The 2025 review cites AI-powered botnets, attacks on AI model APIs, AI side-channel attacks on cryptography, APT use of hacktivist personas, and expanded Roskomnadzor powers to isolate or reroute Russian internet traffic from March 2026. For 2026, F5 expects Model Context Protocol (MCP) to become the universal connector for AI agents and to expand the attack surface. It also expects third-party ID-verification networks to become prime breach targets, bot defense to shift from proving humanity to judging intent, and quantum hype to reach a credibility checkpoint. Overreliance on AI outputs and continued ClickFix social engineering round out the list. This is forward-looking analysis, not a report of a specific incident.

    Technical Details

    • MCP: servers will accumulate OAuth tokens, filesystem reach and workflow privileges. F5 cites 2025 faults including RCE in poorly isolated tool runners, authentication bypass in capability discovery, tool poisoning and prompt-driven data exfiltration. It also cites the "lethal trifecta" as hard to mitigate.
    • ID verification: centralized hubs holding passports, licenses and face videos become high-value targets. F5 predicts "re-verify" ClickFix lures, replay of old proofs, misconfigured storage, over-permissive client keys, deepfake pressure on liveness checks, and a black market for pre-verified personas.
    • Agentic bots: delegated sessions will carry real user tokens, so defenders must assess session motive through sequences, cadence and semantics rather than identity alone.
    • Quantum: the near-term risk is implementation drag and AI-assisted side-channel analysis (timing leaks, cache behavior, brittle hybrid fallbacks), not sudden cryptographic collapse. "Harvest now, decrypt later" remains a concern.
    • AI overreliance: cascading automated decisions and AI supply chain risks such as model poisoning.
    • ClickFix: fake CAPTCHAs and liveness checks, and pre-filled scripts disguised as repair commands, shared in chat and collaboration tools.

    Remediation

    • Treat AI agent behavior as trackable and constrainable: signed capability manifests, scanning of MCP components and agent-to-tool-to-data telemetry.
    • Use purpose-bound sessions with scoped grants for delegated agents.
    • Adopt zero-retention and privacy-preserving identity models.
    • Build crypto agility and run post-quantum pilots.
    • Add autonomy reviews and policy tripwires outside model judgement, and track provenance of models and data.
    • Update awareness training from "don't click links" to "don't copy commands blindly", and detect repeated paste actions and sudden privilege escalations.