LATIDIA · Ciberseguridad

Cuando los agentes parecen balizas: Evasión de NIDS por tráfico de protocolo de contexto de modelo

arXiv:2609.19091v1 Tipo de Anuncio: nuevo Resumen: El Protocolo de Contexto Modelo (MCP) estandariza la comunicación entre agentes autónomos de Inteligencia Artificial (IA) y herramientas remotas a través de HTTP Transmisible. Este cambio introduce

La noticia

arXiv:2609.19091v1 Announce Type: new Abstract: The Model Context Protocol (MCP) standardizes communication between autonomous Artificial Intelligence (AI) agents and remote tools over Streamable HTTP. This shift introduces a class of machine-generated, authenticated, and high-frequency JSON-RPC traffic directly into enterprise networks. Enterprise network defenders have historically relied on machine-like cadence as an Indicator of Compromise (IoC). In this study, we show that without explicit network-layer indication, MCP traffic structurally and temporally resembles Command and Control (C2) beaconing behavior, specifically the polling architectures used by advanced persistent threats like Cobalt Strike. Counter to theoretical assumptions about machine-generated polling, our measurements reveal a visibility gap: standard enterprise Intrusion Detection Systems (IDS) and behavioral