Loading story…
Two newly disclosed vulnerabilities affected software built around the Model Context Protocol (MCP), highlighting security weaknesses in AI-agent tooling. CVE-2026-63119 impacts the MCP Ruby SDK distributed as the mcp gem before version 0.23.0, where unbounded reads from stdio streams can let a connected peer or spawned subprocess send newline-free data until memory is exhausted, causing denial of service. Separately, CVE-2026-54785 affects the gemini-bridge MCP server's file-handling logic, where improper path validation in _resolve_path allows directory traversal and local file disclosure outside the configured workspace, potentially exposing sensitive files through Gemini query responses.
The disclosures come as MCP adoption expands and security guidance around AI-agent integrations matures. The MCP specification and introduction describe the protocol as a standard way to connect models with external tools and data sources, while recent security research has warned that tool-calling systems introduce risks including prompt injection, excessive privilege, SSRF, and data leakage. In parallel, the OpenID Foundation published draft COAZ and COAZ-MCP specifications to bring standardized authorization to MCP message flows before tool execution, and practitioner research on MCP deployments has emphasized authentication, input validation, logging, and least-privilege design as necessary safeguards for enterprise use.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-63119 report says the denial-of-service vulnerability in the MCP Ruby SDK was published in the NVD on 2026-07-29.
MCP Ruby SDK version 0.23.0 was officially released on 2026-07-07, adding a 4 MiB line-length limit, newline validation, and related transport hardening to address the stdio memory exhaustion issue.
The CVE-2026-63119 report states that the initial fix for stdio transport unbounded reads in the MCP Ruby SDK was completed on 2026-06-02.
On 2025-10-29, Flatt Security Research published an analysis of security risks and mitigations for LLM function-calling and MCP-style tool integrations, including SSRF, prompt injection, and excessive delegation.
The Model Context Protocol specification reference is explicitly versioned as 2025-03-26, indicating a specification release or publication point for that dated version.
A Tier Zero Security blog post states that Anthropic introduced the Model Context Protocol as an open standard for connecting AI models to external tools and data sources in November 2024.
A CVE report disclosed CVE-2026-54785, a directory traversal and local file read issue in gemini-bridge's consult_gemini_with_files workflow caused by improper path validation in _resolve_path.
An OpenID Foundation post announced the publication of two draft specifications, the COAZ Framework and the COAZ-MCP Binding, to standardize authorization for APIs and MCP-based AI agent workflows.
On 29 April 2025, Tier Zero Security published a write-up describing a locally built MCP server for Elasticsearch-based threat hunting with Claude Desktop, along with security considerations for MCP deployments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourceopenid.net
Open sourcecvereports.com
Open sourceflatt.tech
Open sourcetierzerosecurity.co.nz
Open sourcemodelcontextprotocol.io
Open sourcemodelcontextprotocol.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Security researchers warned that the *Model Context Protocol (MCP)*—used to let AI assistants connect to local tools and enterprise SaaS data—creates a significant attack surface when organizations install or authorize MCP “servers” and tool integrations. Praetorian highlighted that **locally hosted MCP servers run with the user’s privileges** and can therefore execute arbitrary commands, access local files, install malware, and exfiltrate data while masquerading as legitimate productivity tooling; it also described **“MCP server chaining,”** where a malicious local MCP server abuses data and actions flowing through a trusted remote integration (e.g., Slack/Google Drive) without needing to compromise the official provider. Separately, Gopher Security emphasized a **trust and auditability gap** in MCP deployments: standard logging for remote tool execution can be incomplete or tampered with, and organizations often cannot prove what code ran or what parameters were used inside a remote “black box” execution environment. The post described “puppet”/interception-style scenarios where an attacker could alter an MCP request (e.g., changing tool-call parameters to trigger data exfiltration or unauthorized actions) while returning plausible “success” responses, and proposed cryptographic approaches (e.g., **zero-knowledge proofs**) to make MCP tool execution verifiable rather than relying on mutable logs.
Jun 29, 2026
Researchers at **OX Security** disclosed a design-level weakness in Anthropic’s **Model Context Protocol (MCP)** that can allow **arbitrary OS command execution** through unsafe `STDIO` transport behavior, creating a broad AI supply-chain risk. The flaw is reported to propagate through Anthropic’s official MCP SDKs into downstream tools and agents, with researchers linking it to at least **10 high- and critical-severity vulnerabilities** across widely used projects. Reported impacts include exposure of sensitive data such as API keys, chat histories, internal databases, and developer workstations, while estimates of exposure range from more than **7,000 publicly accessible servers** to as many as **200,000 servers** potentially at risk. Affected or cited projects include **LangFlow, Flowise, GPT Researcher, Upsonic, Windsurf, Claude Code, Cursor, Gemini-CLI, GitHub Copilot, LiteLLM,** and **LettaAI**. OX Security said it began reporting the issue to Anthropic in late 2025, but Anthropic reportedly treated the behavior as expected and responded by updating security guidance rather than changing the protocol architecture. Researchers described four main abuse paths: direct command injection, hardening bypass, zero-click or near-zero-click prompt injection in AI IDEs and coding assistants, and malicious MCP marketplace submissions that can execute commands on developer machines; they urged organizations to restrict public exposure, sandbox MCP-enabled services, treat external MCP configurations as untrusted, monitor MCP tool use, and install MCP servers only from verified sources.
Jun 29, 2026