Hack The Box: How MCP Inspector Turns AI Tooling Into a New Attack Surface

The Kobold machine from Hack The Box Season 10 makes an important point: new AI-related risks appear not only in the models themselves, but also in the tools developers use to run them. In this walkthrough, the attack starts at MCP Inspector, a dev utility for AI servers. The chain then follows a familiar infrastructure-security pattern: code execution, reading local files inside the container, credential reuse and privilege escalation through Docker, ending in full system takeover.

Kobold is rated as an Easy machine, but its value lies not in how hard it is to exploit but in how realistic the combination of vulnerabilities is. The author shows how a service for debugging and inspecting MCP components can suddenly become an external perimeter. For teams that assemble an AI stack from servers, connectors and auxiliary tools, this is an uncomfortable reminder: anything connected to a model and with access to the local environment automatically becomes part of the attack surface. And such elements are often the least protected, because they are considered internal, temporary or "for developers only".

The first stage of the chain is RCE through MCP Inspector. This step alone changes the threat picture: an attacker does not need to break the main application if a less protected tool with extended capabilities sits next to it.

Once code is running inside the container, the attacker moves to LFI, that is, reading local files. In practice this is one of the most productive stages of any attack on containerized services: configs, environment variables, logs, keys, service tokens and build artifacts often sit in predictable places. Even if the secrets themselves are not handed over directly, a leak of the directory structure, service names or internal addresses already speeds up further progress.

The next key point is credential reuse. This is an especially common problem in AI projects: teams quickly spin up experimental services, copy .env files, duplicate passwords across containers and leave identical credentials for different roles. In this walkthrough, it is secret reuse that lets the attacker move from local access to more sensitive components of the system, and then exploit Docker configuration errors to escalate privileges.

The write-up shows two independent paths to full control of the machine, which underlines the main point: once an attacker has code inside a container, the Docker socket, excess capabilities, unsafe mounts and overly broad access to host resources quickly turn the container from a barrier into a convenient stepping stone.

It is also useful that the author maps the attack to MITRE ATT&CK. This turns a step-by-step machine takeover into practical material for defenders: you see not only the sequence of actions but also the classes of techniques: initial execution, discovery, collection, credential access, lateral movement and privilege escalation. That helps blue teams and DevSecOps match the lab scenario to real logs, alerts and detection measures.

The main thesis reaches well beyond a single machine: the MCP ecosystem, including inspectors, proxies, connectors and local bridges to files, the network and secrets, is becoming a new attack surface precisely because it sits at the junction of several trusted zones.

What does this mean in practice?

Teams building AI services can no longer protect only the model API and the user interface. They need to take dev tools off public access, enable authentication even for "internal" utilities, forbid secret reuse, trim container privileges, audit Docker settings and log activity around MCP components as carefully as around core production services.

Kobold works well because, without excess theory, it shows that the next serious incident in an AI stack may start not with the model but with a small utility that nobody considered critical.