Loading story…
Cloudflare has introduced WriteGuard, a private beta security layer for Model Context Protocol (MCP) servers that intercepts agent requests, enforces tool-specific policies, and logs blocked or failed actions for centralized auditing. The service is designed to curb the risk of AI agents using existing OAuth-backed access to perform sensitive write operations across databases, internal APIs, GitHub, GitLab, Jira, Google Workspace, SaaS platforms, and internal wikis. Cloudflare said WriteGuard can apply consistent controls across multiple MCP servers without requiring changes to each server, while preserving attribution by tying MCP client and session context to the human user and scrubbing sensitive values before audit events are stored.
The launch comes as MCP-connected tools are gaining direct write access to production workflows. ElevenLabs recently introduced a hosted MCP connector that lets Claude inspect and modify ElevenAgents configurations, including changing prompts, voices, languages, retrieving transcripts, generating sample speech, estimating costs, and even deleting agents from a chat interface. ElevenLabs said it uses OAuth plus organization- and session-level controls and urged users to review tool calls before approval, warning that approval alone does not guarantee safe or correct downstream behavior; the company also pointed teams to testing, versioning, and CLI/API-based rollout practices for stronger governance.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
On Monday, ElevenLabs introduced a hosted MCP connector that gives Claude read and write access to ElevenAgents in an authenticated workspace via OAuth. The connector lets developers inspect and modify agent configurations, estimate change costs, and perform actions including transcript retrieval and agent deletion, with organization- and session-level controls.
Cloudflare introduced WriteGuard, a private beta security layer for MCP servers that intercepts requests, enforces tool-specific policies, and records blocked or failed actions for auditing. The product is designed to reduce risks from AI agents using write-capable access to external tools and services through MCP.
ElevenLabs released an open-source MCP server for Claude Desktop, Cursor, and other MCP clients. The locally run server used an ElevenLabs API key and supported speech generation, voice cloning, and audio transcription.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
infoq.com
Open sourcethenewstack.io
Open sourceblog.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Model Context Protocol (MCP)** has been updated to a fully stateless design in the `2026-07-28` specification, removing required sessions, the `initialize` handshake, and the `Mcp-Session-Id` header so MCP servers can run as standard HTTP services without sticky-session infrastructure. The update also replaces stream-dependent elicitation with **Multi Round-Trip Requests**, adds MCP-specific HTTP headers for gateway and security controls, and tightens authorization through issuer identification and canonical resource audience handling. Cloudflare said its Agents SDK and Workers OAuth Provider already support the new model, and cited production adoption by **Sentry** and **Linear**. At the same time, major vendors including **OpenAI, AWS, Cursor, GitHub, Microsoft, and Vercel** backed **Agent Plugins 1.0.0**, a vendor-neutral format for packaging MCP servers and agent skills for use across clients and runtimes. The push for interoperability comes with growing security concerns: researchers published new **Nuclei** templates to detect publicly exposed AI agent configuration files such as `CLAUDE.md`, `AGENTS.md`, Cursor rules, and `vscode-mcp.json`, warning that misconfigured web roots can leak internal workflows, tool settings, and project conventions as organizations expand AI agent deployments.
Aug 8, 2026
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Security researchers warned that the *Model Context Protocol (MCP)*—used to let AI assistants connect to local tools and enterprise SaaS data—creates a significant attack surface when organizations install or authorize MCP “servers” and tool integrations. Praetorian highlighted that **locally hosted MCP servers run with the user’s privileges** and can therefore execute arbitrary commands, access local files, install malware, and exfiltrate data while masquerading as legitimate productivity tooling; it also described **“MCP server chaining,”** where a malicious local MCP server abuses data and actions flowing through a trusted remote integration (e.g., Slack/Google Drive) without needing to compromise the official provider. Separately, Gopher Security emphasized a **trust and auditability gap** in MCP deployments: standard logging for remote tool execution can be incomplete or tampered with, and organizations often cannot prove what code ran or what parameters were used inside a remote “black box” execution environment. The post described “puppet”/interception-style scenarios where an attacker could alter an MCP request (e.g., changing tool-call parameters to trigger data exfiltration or unauthorized actions) while returning plausible “success” responses, and proposed cryptographic approaches (e.g., **zero-knowledge proofs**) to make MCP tool execution verifiable rather than relying on mutable logs.
Jun 29, 2026