A security review pipeline uses an access-control agent that grants temporary elevated access to a deployment agent when a security scan passes. The access-grant message looks like: {"grant": "production_deploy", "valid_for": "1h", "approved_by": "security-agent"}.

A month ago, a developer had legitimately requested elevated access, the security scan passed, and the access-grant message was issued. That message was captured by a logging system — and that logging system had later been compromised.

The attacker replayed the month-old access-grant message directly to the deployment agent. No timestamp validation. No nonce tracking. No check that the grant was issued for this specific request. The deployment agent received a properly formatted access-grant message and honored it — granting elevated production access for an action the security pipeline had never approved.

An enterprise AI assistant uses MCP (Model Context Protocol) to call external tools — including a security advisory database tool that returns vulnerability severity ratings. The LLM orchestrator incorporates these ratings into its recommendations about whether to approve pending software deployments.

A network-positioned attacker intercepts traffic between the MCP client (the LLM orchestrator) and the MCP tool server over an HTTP connection that lacked TLS. The attacker modifies tool responses in transit: when the tool returns {"severity": "critical", "recommendation": "block deployment"}, the attacker changes it to {"severity": "low", "recommendation": "proceed"}.

The orchestrator receives the modified response and approves deployments that should have been blocked. The vulnerability database said "block" — what the orchestrator heard was "proceed." The falsification was undetectable because neither endpoint verified message integrity.