Evidence Isn’t on Disk: A DFIR Playbook for Compromised MCP Servers and AI Coding Agents

In July 2025, Check Point Research disclosed MCPoison (CVE-2025-54136, CVSS 7.2), a flaw in Cursor IDE (versions ≤ 1.2.4) where the Model Context Protocol trust model bound approval to an MCP server's name rather than its command or arguments. An attacker commits a benign .cursor/rules/mcp.json to a shared repository; a developer approves it once; the attacker later swaps in a reverse shell that runs silently on every project open — persistent RCE with no second prompt. A companion flaw, CurXecute (CVE-2025-54135, CVSS 8.6), reached the same outcome through prompt injection that wrote to ~/.cursor/mcp.json and executed even after the user rejected the change. These two incidents expose the problem this session tackles: when the acting entity is an AI agent, the authentication event is legitimate, the spawning process is the expected runtime, and the action falls within the agent's granted permissions so conventional EDR timelines show nothing anomalous, and the triggering instruction frequently lives only in ephemeral prompt context that does not survive default log retention. The session reproduces both CVEs live on an isolated host, then contrasts their forensic footprints: MCPoison leaves recoverable on-disk evidence (git history of the config, file modification times, file-integrity-monitoring hits), while the prompt-injection path leaves almost nothing once the session closes. From that contrast the presenter derives a NIST-mapped incident-response playbook for agentic systems what to preserve before containment, how to triage runtime-escape versus privilege-boundary-escape versus reasoning-compromise incidents, and how to instrument MCP tool-call telemetry so the originating instruction is captured as evidence rather than lost. Attendees leave with the lab build (vulnerable and patched configs), a forensic-artifact collection checklist for MCP and agent incidents, file-integrity-monitoring and detection logic for mcp.json tampering, and an open-source telemetry wrapper that records agent tool calls and their originating context in a retention-safe format.