Loading story…
Model Context Protocol (MCP) tools are expanding the attack surface of LLM-powered autonomous agents by connecting them to external functions, services, and sensitive data. Attackers can exploit conventional implementation defects—including reported command-injection and CSRF issues—or manipulate agent behavior through indirect prompt injection hidden in tool metadata, parameters, retrieved content, and multi-tool workflows. Documented techniques include tool poisoning, encoded or invisible instructions, tool redefinition “rug pulls,” tool-name collisions, passive influence, and orchestration injection.
Successful MCP attacks can cause secret exfiltration, unauthorized command execution, financial fraud, and publication of private data. Organizations deploying MCP-enabled agents should restrict tools to trusted sources, enforce least-privilege access and sandboxing, require human approval for sensitive operations, disable auto-run and persistent “always allow” settings, manually review tool definitions and updates, and maintain auditable clients with comprehensive tool-invocation logging.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
MCP maintainers released a specification update emphasizing issuer validation, issuer-bound client credentials, and Client ID Metadata Documents as the preferred client-registration method, strengthening the protocol's authorization model.
In July 2026, Island analyzed 33,563 MCP server builds and found apparent instruction or output-manipulation signals in about 3.3% of them, while assessing 49% as having potential manipulation capability. The analysis also highlighted covert logging instructions in a marketing-analytics MCP dependency and a postmark-mcp update that added a BCC backdoor copying outbound email to an attacker-controlled address.
An attacker reportedly used prompt injection against a GitHub MCP server to obtain private repository data. The incident was attributed to a personal access token whose permissions exceeded those needed for the requested task.
Researchers examining publicly available MCP server implementations reported command-injection flaws in 43% of tested implementations and unrestricted URL fetching in 30%.
A pentest described a hidden instruction in an MCP tool's description that caused an agent to read ~/.ssh/id_rsa and return the private key in a chat session, without exploiting a conventional CVE. The demonstration highlights MCP tool metadata as a prompt-injection and credential-exfiltration vector.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
8 references tracked. Mallory keeps watching after this page renders.
thenewstack.io
Open sourcecodeby.net
Open sourcescworld.com
Open sourcethenewstack.io
Open sourceisland.io
Open sourcearxiv.org
Open sourceelastic.co
Open sourceequixly.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers warned that the *Model Context Protocol (MCP)*—used to let AI assistants connect to local tools and enterprise SaaS data—creates a significant attack surface when organizations install or authorize MCP “servers” and tool integrations. Praetorian highlighted that **locally hosted MCP servers run with the user’s privileges** and can therefore execute arbitrary commands, access local files, install malware, and exfiltrate data while masquerading as legitimate productivity tooling; it also described **“MCP server chaining,”** where a malicious local MCP server abuses data and actions flowing through a trusted remote integration (e.g., Slack/Google Drive) without needing to compromise the official provider. Separately, Gopher Security emphasized a **trust and auditability gap** in MCP deployments: standard logging for remote tool execution can be incomplete or tampered with, and organizations often cannot prove what code ran or what parameters were used inside a remote “black box” execution environment. The post described “puppet”/interception-style scenarios where an attacker could alter an MCP request (e.g., changing tool-call parameters to trigger data exfiltration or unauthorized actions) while returning plausible “success” responses, and proposed cryptographic approaches (e.g., **zero-knowledge proofs**) to make MCP tool execution verifiable rather than relying on mutable logs.
Jun 29, 2026
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Internet-exposed Model Context Protocol (MCP) servers are frequently running without authentication, allowing anonymous users to enumerate available tools, retrieve sensitive enterprise data, and in some cases access destructive backend actions, credentials, or code-execution capabilities. Wiz found MCP deployments in 80% of surveyed cloud environments; roughly one in six environments had at least one publicly exposed server, 70% of those servers disclosed tool inventories anonymously, and 42% returned real data to unauthenticated tool calls. Many affected deployments use the pre-authentication `2024-11-05` MCP protocol version rather than releases supporting OAuth 2.1 authorization, introduced in March 2025. Organizations should inventory internet-facing MCP endpoints, restrict public exposure, require authorization before tool execution, apply least-privilege permissions to connected backend credentials, and retain agent prompt and tool-invocation logs for detection and investigation.
Sep 3, 2026