Integrations
How AAM's MCP Server integrates with Akamai's AI security stack to protect agent traffic flowing in both directions.
The reverse prompt injection problem
MCP servers built from your APIs return real data — support tickets, documents, database records, third-party responses — directly into an agent's context. That's a new attack surface most teams aren't watching.
Injection in reverse
Ordinary prompt injection hides malicious instructions in what a user types. Reverse prompt injection hides them in what a tool returns — a comment field, a document body, a third-party API payload — that an MCP tool call passes straight into the agent's context. The agent can't tell the difference between real data and an instruction planted inside it.
Why it's dangerous
Once hijacked, the agent is still operating with its original permissions. A single poisoned tool response can cause it to call other tools, exfiltrate data, or take actions the user never asked for — using access the user themselves granted.
Worked example: a poisoned support ticket
Request: the agent fetches the ticket
Response: the Tickets API returns ticket #4471
On the way back, MCP Server (Firewall for AI) inspects the response before it reaches the agent
The planted instruction is detected before the agent sees it. The would-be call to send_webhook exfiltrating the customer's name, email, and SSN to evil-collector.io never happens.
The agent still gets the legitimate part of the ticket — "My login is broken, can you help?" — and responds to the customer's actual request.
How Firewall for AI helps: Firewall for AI mirrors traffic in both directions — the outbound prompt and the inbound response — through behavioral models trained on injection and jailbreak patterns. Applied to MCP Server traffic, every tool response headed back to an agent is inspected before the agent can act on it, so instructions planted inside API or document data are caught before they hijack downstream tool calls — with no added latency, since mirroring happens asynchronously.