Loading story…
Internet-exposed Model Context Protocol (MCP) servers are frequently running without authentication, allowing anonymous users to enumerate available tools, retrieve sensitive enterprise data, and in some cases access destructive backend actions, credentials, or code-execution capabilities. Wiz found MCP deployments in 80% of surveyed cloud environments; roughly one in six environments had at least one publicly exposed server, 70% of those servers disclosed tool inventories anonymously, and 42% returned real data to unauthenticated tool calls.
Many affected deployments use the pre-authentication 2024-11-05 MCP protocol version rather than releases supporting OAuth 2.1 authorization, introduced in March 2025. Organizations should inventory internet-facing MCP endpoints, restrict public exposure, require authorization before tool execution, apply least-privilege permissions to connected backend credentials, and retain agent prompt and tool-invocation logs for detection and investigation.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
A March 2025 revision to the Model Context Protocol specification added authentication support based on OAuth 2.1. The revision also introduced tool annotations, including readOnlyHint and destructiveHint, to distinguish read operations from potentially dangerous writes.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Model Context Protocol (MCP) tools are expanding the attack surface of LLM-powered autonomous agents by connecting them to external functions, services, and sensitive data. Attackers can exploit conventional implementation defects—including reported command-injection and CSRF issues—or manipulate agent behavior through indirect prompt injection hidden in tool metadata, parameters, retrieved content, and multi-tool workflows. Documented techniques include tool poisoning, encoded or invisible instructions, tool redefinition “rug pulls,” tool-name collisions, passive influence, and orchestration injection. Successful MCP attacks can cause secret exfiltration, unauthorized command execution, financial fraud, and publication of private data. Organizations deploying MCP-enabled agents should restrict tools to trusted sources, enforce least-privilege access and sandboxing, require human approval for sensitive operations, disable auto-run and persistent “always allow” settings, manually review tool definitions and updates, and maintain auditable clients with comprehensive tool-invocation logging.
Sep 12, 2026
Security researchers warned that the *Model Context Protocol (MCP)*—used to let AI assistants connect to local tools and enterprise SaaS data—creates a significant attack surface when organizations install or authorize MCP “servers” and tool integrations. Praetorian highlighted that **locally hosted MCP servers run with the user’s privileges** and can therefore execute arbitrary commands, access local files, install malware, and exfiltrate data while masquerading as legitimate productivity tooling; it also described **“MCP server chaining,”** where a malicious local MCP server abuses data and actions flowing through a trusted remote integration (e.g., Slack/Google Drive) without needing to compromise the official provider. Separately, Gopher Security emphasized a **trust and auditability gap** in MCP deployments: standard logging for remote tool execution can be incomplete or tampered with, and organizations often cannot prove what code ran or what parameters were used inside a remote “black box” execution environment. The post described “puppet”/interception-style scenarios where an attacker could alter an MCP request (e.g., changing tool-call parameters to trigger data exfiltration or unauthorized actions) while returning plausible “success” responses, and proposed cryptographic approaches (e.g., **zero-knowledge proofs**) to make MCP tool execution verifiable rather than relying on mutable logs.
Jun 29, 2026
AIR Security researchers identified **155 Model Context Protocol (MCP)** servers in the Official MCP Registry whose underlying services were offline while their associated domains had expired. An attacker can re-register one of those domains and operate a malicious server at the trusted registry address, potentially causing AI agents that retain the stale MCP configuration to connect to attacker-controlled infrastructure. A hijacked MCP server could alter tool definitions, inject prompts, redirect agent actions, and exfiltrate data available to the agent. The exposure highlights unresolved MCP supply-chain weaknesses, including insufficient runtime endpoint verification, unsigned or unpinned server dependencies, and permissive tool execution; organizations should inventory MCP integrations, remove stale entries, verify and pin server identities, enforce least privilege and approval controls, and govern access through allowlists, internal registries, and monitoring.
Sep 3, 2026