Some of the most dangerous AI attack patterns don’t show up in any single request. Instead, they only appear as a pattern across a session. Because the Impart Security plugin correlates signals across requests, not just within one, it can catch threats a single-message filter would miss entirely.
Excessive agent tool use. An AI agent starts calling far more distinct tools than its task requires. This is a common signature of a compromised or hijacked agent. For example, an agent may have been prompt-injected into exploring your entire tool surface, or may be testing which tools it can reach with a stolen identity. Any one of those tool calls looks completely legitimate on its own; only the pattern across a session gives it away. Left unchecked, this kind of agent drift can mean data loss, runaway cost, or actions taken on your users’ behalf that can’t be undone. Impart tracks how many distinct tools a caller invokes within a session and flags or blocks callers that cross normal thresholds, catching an agent that’s drifted outside its intended scope before it can do real damage.
MCP catalog drift (“rug-pull” attacks). An MCP server changes the tools, prompts, or resources it advertises after a client has already started trusting its catalog, or serves a tool that was never advertised in the first place. This is a supply-chain-style attack: a server can look completely benign during initial discovery, then swap in a malicious tool mid-session once trust is established. Nothing about a single tool invocation reveals the swap; only comparing it against what was originally advertised does. A successful rug-pull can expose sensitive data or trigger unauthorized actions across every session that trusted the server, the kind of supply-chain compromise that’s expensive to detect and worse to explain to customers. Impart snapshots the catalog an MCP server advertises and checks every later invocation in that session against it, flagging tools that were never advertised or catalogs that changed mid-session.
Persistent LLM prompt injection. An attacker sends prompt injection or jailbreak attempts repeatedly, often adjusting their approach each time to stay just under the radar of a single-message filter. One borderline prompt may not be conclusive enough to block without risking false positives on real users, but an attacker who keeps trying is a much clearer signal of intent, and a filter with no memory has no way to notice the pattern. A determined attacker who eventually succeeds can extract sensitive data, generate brand-damaging output, or trigger a compliance incident. What matters isn’t whether the first attempt gets through; it’s whether the hundredth one does. Impart tracks flagged prompt-injection attempts per session, IP, and device, and escalates enforcement, temporarily blocking a source once it crosses a violation threshold, catching persistent attackers a single-message scan alone would miss.
