Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label MCP prompt injection. Show all posts

How MCP is preparing AI systems for a new era of travel automation

 




Most digital assistants today can help users find information, yet they still cannot independently complete tasks such as organizing a trip or finalizing a booking. This gap exists because the majority of these systems are built on generative AI models that can produce answers but lack the technical ability to carry out real-world actions. That limitation is now beginning to shift as the Model Context Protocol, known as MCP, emerges as a foundational tool for enabling task-performing AI.

MCP functions as an intermediary layer that allows large language models to interact with external data sources and operational tools in a standardized way. Anthropic unveiled this protocol in late 2024, describing it as a shared method for linking AI assistants to the platforms where important information is stored, including business systems, content libraries and development environments.

The protocol uses a client-server approach. An AI model or application runs an MCP client. On the opposite side, travel companies or service providers deploy MCP servers that connect to their internal data systems, such as booking engines, rate databases, loyalty programs or customer profiles. The two sides exchange information through MCP’s uniform message format.

Before MCP, organizations had to create individual API integrations for each connection, which required significant engineering time. MCP is designed to remove that inefficiency by letting companies expose their information one time through a consolidated server that any MCP-enabled assistant can access.

Support from major AI companies, including Microsoft, Google, OpenAI and Perplexity, has pushed MCP into a leading position as the shared standard for agent-based communication. This has encouraged travel platforms to start experimenting with MCP-driven capabilities.

Several travel companies have already adopted the protocol. Kiwi.com introduced its MCP server in 2025, allowing AI tools to run flight searches and receive personalized results. Executives at the company note that the appetite for experimenting with agentic travel tools is growing, although the sector still needs clarity on which tasks belong inside a chatbot and which should remain on a company’s website.

In the accommodation sector, property management platform Apaleo launched an MCP server ahead of its competitors, and other travel brands such as Expedia and TourRadar are also integrating MCP. Industry voices emphasize that AI assistants using MCP pull verified information directly from official hotel and travel systems, rather than relying on generic online content.

The importance of MCP became even more visible when new ChatGPT apps were announced, with major travel agencies included among the first partners. Experts say this marks a significant moment for how consumers may start buying travel through conversational interfaces.

However, early adopters also warn that MCP is not without challenges. Older systems must be restructured to meet MCP’s data requirements, and companies must choose AI partners carefully because each handles privacy, authorization and data retention differently. LLM processing time can also introduce delays compared to traditional APIs.

Industry analysts expect MCP-enabled bookings to appear first in closed ecosystems, such as loyalty platforms or brand-specific applications, where trust and verification already exist. Although the technology is progressing quickly, experts note that consumer-facing value is still developing. For now, MCP represents the first steps toward more capable, agentic AI in travel.



AI Code Editor Cursor Hit by ‘CurXecute’ Vulnerability Allowing Remote Code Execution

 

A newly discovered flaw, dubbed CurXecute, affects nearly all versions of the AI-powered code editor Cursor and can be exploited to execute remote code with full developer privileges.

The security loophole, now tracked as CVE-2025-54135, can be triggered by feeding the AI agent a specially crafted malicious prompt, enabling attacker-controlled commands.

Cursor IDE uses AI agents to help developers work faster by integrating with external systems via the Model Context Protocol (MCP). According to researchers, successful exploitation of CurXecute could pave the way for ransomware attacks, data theft, and other malicious activity.

Prompt-Injection Attack Vector

CurXecute operates similarly to EchoLeak, a previously identified vulnerability in Microsoft 365 Copilot that allowed theft of sensitive data without user interaction. Researchers at AI cybersecurity firm Aim Security discovered that even local AI agents can be influenced by external data sources to perform harmful actions.

Cursor’s MCP support extends agent capabilities by linking it with external data and tools.

“MCP turns a local agent into a Swiss-army knife by letting it spin up arbitrary servers - Slack, GitHub, databases - and call their tools from natural language” – Aim Security

However, this flexibility introduces risk, as exposure to untrusted data can compromise the agent’s control flow. A threat actor could hijack an agent’s session and privileges, enabling them to act as the legitimate user.

Through an externally hosted prompt injection, attackers could modify the ~/.cursor/mcp.json configuration file to execute arbitrary commands remotely. Researchers noted that Cursor does not require user confirmation for changes to this file. Even rejected suggestions can still trigger the malicious code execution.

Aim Security’s report to BleepingComputer warns that adding standard MCP servers, such as Slack, to Cursor could inadvertently expose the agent to hostile content. For example, a malicious prompt posted in a public Slack channel could carry an injection payload targeting the configuration file. If the victim later asks the agent to summarize the messages, the payload—potentially a shell—would be saved to disk without approval.

“The attack surface is any third-party MCP server that processes external content: issue trackers, customer support inboxes, even search engines. A single poisoned document can morph an AI agent into a local shell” – Aim Security.

Aim Security privately disclosed CurXecute to Cursor on July 7. The vendor issued a patch the next day, merging it into the main branch. On July 29, Cursor version 1.3 was released, including multiple improvements and a fix for the flaw.

Cursor’s security advisory assigned the issue a medium severity score of 8.6. Users are strongly advised to update to the latest version to mitigate known risks.