AdsAgent — agentic threat model

Not certain from the listing — The specific LLM is not defined as this is an MCP tool. However, the underlying model is highly vulnerable to indirect prompt injection via ad campaign data or keywords, which could hijack the agent's decision-making process.

Not certain from the listing — It reads Google Ads performance data, but the storage mechanism (RAG, vector databases, or local caching) is unspecified. If performance data is cached insecurely, it could lead to unauthorized data exposure.

Built as an MCP (Model Context Protocol) tool. The primary risk is tool misuse where malicious prompts or compromised orchestrators abuse the keyword and bid management tools to drain ad budgets.

As an open-source MCP tool, deployment security depends on the host environment. The primary infrastructure threat is the insecure storage of Google Ads OAuth tokens, which, if compromised, grant direct API access to live accounts.

The listing highlights 'action confirmation and scope' as key controls. Without strict, out-of-band human-in-the-loop (HITL) confirmation and real-time anomaly detection on budget changes, malicious or erroneous optimizations will go unnoticed until financial damage occurs.

Uses OAuth for authentication to Google Ads. Compliance risks are high due to direct financial impact; strict scope limitation (least privilege) is critical to prevent the agent from accessing or modifying unauthorized campaigns.

Designed to operate within the MCP ecosystem, making it susceptible to agent-to-agent trust abuse. A compromised upstream orchestrator agent could command AdsAgent to perform unauthorized bid increases or campaign pauses.