When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling

Details

AI agents are moving from read-only tools to active participants in financial systems. In the MCP ecosystem, the fraction of deployed tools that modify external state has grown from 27% to 65% of tool use — and public blockchains are increasingly among the targets. When an agent makes a mistake or is successfully attacked in a blockchain context, there is no undo. This survey from Karanjai et al. identifies four properties of blockchain execution environments that fundamentally change the threat model for AI agents: irreversibility (failed or manipulated transactions cannot be rolled back), signing authority (the agent holds cryptographic keys that authorize on-chain actions), continuous autonomy (agents operate 24/7 without human checkpoints), and sequence-level composition (multiple transactions can be chained in a single attack). The paper builds a Web3 risk-mapping matrix that ties each attack class (prompt injection, tool poisoning, MCP proxy attacks, etc.) to its amplified blockchain impact, the responsible amplifiers, a representative mitigation, and the residual gap. It synthesizes existing defenses, including emerging blockchain-based mechanisms, and finds them measurably insufficient: current protections stop fewer than 30% of attacks; model-level safety refuses fewer than 3%. For teams building or using AI agents that interact with Web3 — via MCP tools, DeFi protocols, or NFT/DAO tooling — this is a clear-eyed threat landscape. The research agenda derived from the gap analysis points to transaction-level attestation, policy-binding, and sandboxed simulation as the most promising directions.