TLDR: A study comparing Function Calling and Model Context Protocol (MCP) architectures for LLM agents found that architectural choices significantly impact security. Function Calling is more vulnerable to system-centric attacks, while MCP is more susceptible to LLM-centric ones. Complex, multi-stage attacks (91-96% success) are far more effective than simple ones, highlighting the need for architectural-aware security strategies that bridge AI and software security domains.
Large Language Model (LLM) agents are rapidly transforming artificial intelligence, moving beyond simple text generation to become autonomous systems capable of interacting with software environments and external components. These agents are being deployed across critical sectors like healthcare, finance, and customer service, automating complex decision-making and user interactions. However, their widespread adoption brings significant security challenges, combining both AI-specific vulnerabilities and traditional software security risks.
Current research often addresses these two security domains separately, leaving a critical gap. A recent study, “Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms,” by Tarek Gasmi, Ramzi Guesmi, Ines Belhadj, and Jihene Bennaceur, aims to bridge this divide. The researchers conducted a comprehensive evaluation of two prominent LLM agent deployment architectures: Function Calling and the Model Context Protocol (MCP), using a unified framework to classify threats.
Understanding the Architectures and Attack Scenarios
The study tested 3,250 attack scenarios across seven different language models. These scenarios targeted both AI-specific threats, such as prompt injection, and traditional software vulnerabilities like JSON injection and denial-of-service attacks. The attacks were categorized by complexity: simple, composed, and chained.
Function Calling, a widely adopted architecture, centralizes tool definitions and execution logic within the agent’s boundary. This unified approach simplifies management but creates a single point of failure where a successful compromise can rapidly spread across all integrated tools. In contrast, the Model Context Protocol (MCP) uses a distributed client-server model, separating tool execution from the agent’s core reasoning. This separation aims to limit the impact of a breach by containing attacks within specific system tiers.
Key Findings on Vulnerability
The research revealed significant differences in how these architectures handle security. Function Calling showed a higher overall attack success rate of 73.5% compared to MCP’s 62.59%. Function Calling demonstrated greater vulnerability to system-centric attacks, meaning exploits that target the underlying software components and their interactions. This is largely due to its tightly coupled design, where manipulating API parameters or injecting malicious JSON can compromise both the agent’s reasoning and its ability to act.
Conversely, MCP exhibited increased LLM-centric exposure, with a higher attack success rate of 68.28% for vulnerabilities that directly target the language model’s reasoning processes, such as prompt injection. While MCP’s distributed nature offers better containment for tool-layer threats, its context-rich communication protocol provides more avenues for attackers to manipulate the LLM’s understanding and behavior.
A crucial finding was the impact of attack complexity. Simple, single-vector attacks had limited effectiveness. However, attack effectiveness dramatically amplified with complexity. Composed attacks, which combine multiple techniques, showed increased success rates, especially in Function Calling environments. Most alarmingly, chained attacks, which involve multiple stages traversing different system components sequentially, achieved success rates of 91-96% across all configurations. This highlights that real-world threats often exploit a series of interconnected weaknesses rather than isolated flaws.
Interestingly, the study also found a counterintuitive security paradox: advanced reasoning models, despite demonstrating superior initial threat detection, showed higher overall exploitability once their defenses were breached. This suggests that while these models are better at identifying threats, their increased intelligence might also offer more sophisticated pathways for attackers to exploit once a foothold is gained.
Also Read:
- The Hidden Threat: LLM Agents and Complete Computer Takeover
- Unmasking AI Agent Risks: A New Framework for Real-World Safety Evaluation
Implications for Secure Deployment
The study’s results underscore that architectural choices are not merely deployment considerations but fundamentally reshape the threat landscape for LLM agents. Relying on isolated security measures or traditional software security practices alone is insufficient. Effective security requires a holistic approach that considers the interplay between AI-specific threats and traditional software vulnerabilities.
The researchers propose a unified security framework that bridges these domains and provides evidence-based guidance for secure deployment. This includes prioritizing security-first protocol design, integrating architectural security from the outset, and adopting advanced threat assessment methodologies that evaluate complex, multi-stage attack scenarios. For more in-depth technical details, you can refer to the full research paper available at arXiv.org.
Ultimately, securing LLM-based agents demands a shift from component-level hardening to disrupting entire attack paths. Organizations must develop defense strategies that account for the unique characteristics of intelligent, autonomous systems operating in complex, interconnected environments.
