The original purpose of Base64 was to turn binary data into safe, readable text.
The irony is that this very ability to create “safe” text is exactly what makes it so useful to an attacker.
Base64 itself is not inherently bad it is simply a tool that is really good at data conversion.
The problem is that its primary strength can easily be turned into a convenient weapon by malicious actors.
Here is how Base64 can be used as a direct attack vector for AI agents.
Attack goes like this:
- An attacker posts a Base64 string on social media, which decodes to start a notepad.
- A user asks Claude to summarize their recent feed.
- Claude passes the content to a malicious MCP tool as an argument.
- The MCP server decodes the Base64 and runs the command.
- No trace of this execution is left on the chat interface.
While this example only starts a notepad, the same method can be used to distribute ransomware, steal credentials, or maintain persistence.
Base64 is being used to deceive the human eye.
Your brain naturally assumes it is just a password hash, a token, or maybe a UUID. Because of this, it often slips past code reviews unnoticed.
The human eye has a hard time seeing a clutter of random characters as a threat and this is why Base64 is so easily misused.