Loading story…
Security researchers warned that the Model Context Protocol (MCP)—used to let AI assistants connect to local tools and enterprise SaaS data—creates a significant attack surface when organizations install or authorize MCP “servers” and tool integrations. Praetorian highlighted that locally hosted MCP servers run with the user’s privileges and can therefore execute arbitrary commands, access local files, install malware, and exfiltrate data while masquerading as legitimate productivity tooling; it also described “MCP server chaining,” where a malicious local MCP server abuses data and actions flowing through a trusted remote integration (e.g., Slack/Google Drive) without needing to compromise the official provider.
Separately, Gopher Security emphasized a trust and auditability gap in MCP deployments: standard logging for remote tool execution can be incomplete or tampered with, and organizations often cannot prove what code ran or what parameters were used inside a remote “black box” execution environment. The post described “puppet”/interception-style scenarios where an attacker could alter an MCP request (e.g., changing tool-call parameters to trigger data exfiltration or unauthorized actions) while returning plausible “success” responses, and proposed cryptographic approaches (e.g., zero-knowledge proofs) to make MCP tool execution verifiable rather than relying on mutable logs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Akamai published analysis arguing that organizations should treat exposed MCP servers like internet-reachable APIs or web applications that attackers can target directly, without first compromising an AI agent. The article outlined likely server-side attack behaviors including malformed protocol requests, tool and resource enumeration, business-logic extraction, auth flaws, and resource-exhaustion abuse.
An OSINT Team blog post outlined a prompt-injection style attack against OmniChat Desktop in which a malicious third-party MCP weather tool embeds hidden instructions in its tool description. The scenario showed how untrusted MCP metadata could trick the application into exfiltrating a user's email address through an optional request parameter during a weather query.
An InfoSec Write-ups article described a security assessment of a production CMS for hedge funds that exposed administrative functionality through an MCP server accessible from AI clients such as Claude Desktop after OAuth authentication. The article characterized abuse of the MCP server for lateral movement as a critical finding, indicating real-world enterprise risk from MCP-integrated admin tooling.
An InfoSec Write-ups article published on April 20, 2026 highlighted CVE-2025-49596 affecting MCP Inspector as an example of emerging MCP security weaknesses. The piece framed MCP servers as repeating early API security mistakes and emphasized threats such as tool poisoning, rug pull attacks, and confused deputy abuse.
CIO reported that MCP servers had become targets of persistent attacks in multiple forms by early April 2026, including a cited attack case involving Cursor’s built-in browser. The article said CISOs were increasingly prioritizing MCP hardening as experts warned that poisoned tools, tampered connectors, and malicious search sources could hijack AI agent behavior.
Cyber Security News summarized Praetorian's February 2026 findings that MCP servers can be exploited for arbitrary code execution, local data exfiltration, persistence, and AI response manipulation, and highlighted supply-chain risks from dynamic package installation workflows.
Gopher Security described its HEAL framework for securing MCP-based multi-agent systems, emphasizing parameter-level enforcement, context-window monitoring for hidden-instruction attacks, anomaly detection, adaptive access controls, and post-quantum protections.
Praetorian detailed how malicious local MCP servers can execute arbitrary commands with user privileges, access files, install malware, and exfiltrate data, and explained how server chaining can abuse trusted remote integrations without compromising them directly.
Gopher Security published a proposal to address MCP's trust gap by having tools return zero-knowledge proofs alongside outputs, allowing cryptographic verification that specific code ran on specific inputs without exposing secrets.
In February 2026, Praetorian evaluated the MCP ecosystem and created the open-source MCPHammer toolkit to demonstrate MCP server chaining, content injection, and data exfiltration techniques across multiple models and agents.
Anthropic announced the open-source Model Context Protocol (MCP) in November 2024 as a standard for connecting AI assistants to external tools and data sources through standardized server integrations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
akamai.com
Open sourceosintteam.blog
Open sourceinfosecwriteups.com
Open sourceinfosecwriteups.com
Open sourcecio.com
Open sourcecybersecuritynews.com
Open sourcegopher.security
Open sourcepraetorian.com
Open sourcegopher.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers evaluated the risks associated with deploying Model Context Protocol (MCP) servers, which enable AI systems like ChatGPT to interact with external tools and data. One investigation used the GitHub MCP server in conjunction with OpenAI's Codex to analyze code, identify security issues, and propose fixes, highlighting how AI agents can streamline code review and vulnerability management. The study also explored whether AI-driven code analysis could be manipulated to conceal security flaws, emphasizing the importance of context and transparency in automated security workflows. Separately, honeypots simulating MCP server deployments were exposed to the internet to assess real-world attack activity. These honeypots, configured with varying authentication levels, were quickly discovered by internet scanners but did not experience targeted exploitation or MCP-specific attacks. The only notable incident was a controlled proof-of-concept prompt-hijacking flaw in a custom MCP build, which was not observed in the wild. The findings suggest that, while MCP servers are rapidly indexed by threat actors, current risks stem primarily from implementation errors rather than active targeting, underscoring the need for secure deployment practices and ongoing monitoring as MCP adoption grows.
Jun 29, 2026
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jun 30, 2026
The rapid adoption of the Model Context Protocol (MCP) is transforming how AI systems interact with external data sources, tools, and APIs, providing a standardized interface for large language models to connect with enterprise environments. While MCP offers significant convenience and interoperability, it also introduces new security challenges, including risks of prompt injection, tool poisoning, and data exfiltration, as attackers can exploit exposed tool descriptions and prompts to manipulate AI systems or compromise sensitive data. To address these emerging threats, the open-source tool Proximity has been released to scan MCP servers for exposed prompts, tools, and resources, enabling security teams to assess potential vulnerabilities before deployment. Proximity, when paired with the NOVA rule engine, allows analysts to write custom rules to detect suspicious or harmful content, such as prompt injection or jailbreak attempts, helping organizations proactively secure their AI integrations as MCP becomes increasingly prevalent in enterprise environments.
Jun 29, 2026