What is hiding in AI traffic by Anna Baron Garcia

This report outlines how Model Context Protocol (MCP) and agentic AI swarms are reshaping offensive operations by enabling stealthy, event-driven C2 that blends with legitimate enterprise AI traffic, parallelizes and compresses the kill chain, and lowers attacker skill requirements. Citing Anthropic’s findings on a state-linked AI-led campaign as validation, it warns that MCP ecosystems and agent toolchains will become high-value targets and detection will need to pivot from network anomalies to intent and identity-context correlation. The report recommends hardening MCP infrastructure, implementing telemetry-linked behavioral detection, and updating incident response for machine-speed attacks.