Loading story…
AIR Security researchers identified 155 Model Context Protocol (MCP) servers in the Official MCP Registry whose underlying services were offline while their associated domains had expired. An attacker can re-register one of those domains and operate a malicious server at the trusted registry address, potentially causing AI agents that retain the stale MCP configuration to connect to attacker-controlled infrastructure.
A hijacked MCP server could alter tool definitions, inject prompts, redirect agent actions, and exfiltrate data available to the agent. The exposure highlights unresolved MCP supply-chain weaknesses, including insufficient runtime endpoint verification, unsigned or unpinned server dependencies, and permissive tool execution; organizations should inventory MCP integrations, remove stale entries, verify and pin server identities, enforce least privilege and approval controls, and govern access through allowlists, internal registries, and monitoring.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
AIR Security researchers Nadav Dadush, Eliad Mualem, and Roi Snir described MCPJacking, a supply-chain attack in which expired domains behind stale official MCP Registry entries can be re-registered and used to serve attacker-controlled MCP servers. Their scan identified 155 registry entries still marked trusted despite nonfunctioning underlying services and expired domains.
Wiz researcher Gal Nagli published a proof of concept showing that an external MCP server intended to parse GitHub documentation could be exploited to achieve remote code execution on the MCP host.
Wiz announced that its MCP Server for Wiz was available in private preview.
Researcher Guy Goldenberg found injection issues affecting Anthropic's MCP PostgreSQL and Puppeteer servers.
Anthropic introduced the Model Context Protocol (MCP) to connect LLM applications with external data sources and tools.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceanthropic.com
Open sourcewiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Model Context Protocol (MCP) tools are expanding the attack surface of LLM-powered autonomous agents by connecting them to external functions, services, and sensitive data. Attackers can exploit conventional implementation defects—including reported command-injection and CSRF issues—or manipulate agent behavior through indirect prompt injection hidden in tool metadata, parameters, retrieved content, and multi-tool workflows. Documented techniques include tool poisoning, encoded or invisible instructions, tool redefinition “rug pulls,” tool-name collisions, passive influence, and orchestration injection. Successful MCP attacks can cause secret exfiltration, unauthorized command execution, financial fraud, and publication of private data. Organizations deploying MCP-enabled agents should restrict tools to trusted sources, enforce least-privilege access and sandboxing, require human approval for sensitive operations, disable auto-run and persistent “always allow” settings, manually review tool definitions and updates, and maintain auditable clients with comprehensive tool-invocation logging.
Sep 12, 2026
Internet-exposed Model Context Protocol (MCP) servers are frequently running without authentication, allowing anonymous users to enumerate available tools, retrieve sensitive enterprise data, and in some cases access destructive backend actions, credentials, or code-execution capabilities. Wiz found MCP deployments in 80% of surveyed cloud environments; roughly one in six environments had at least one publicly exposed server, 70% of those servers disclosed tool inventories anonymously, and 42% returned real data to unauthenticated tool calls. Many affected deployments use the pre-authentication `2024-11-05` MCP protocol version rather than releases supporting OAuth 2.1 authorization, introduced in March 2025. Organizations should inventory internet-facing MCP endpoints, restrict public exposure, require authorization before tool execution, apply least-privilege permissions to connected backend credentials, and retain agent prompt and tool-invocation logs for detection and investigation.
Sep 3, 2026
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026