Developers once saw the Model Context Protocol as the missing link for smarter AI. It let large language models reach into tools, data sources and external services with a standard set of instructions. Adoption exploded. Yet that speed has now exposed cracks that security teams cannot ignore.
More than 21,000 internet-facing MCP server instances sit exposed today. Nearly 92 percent of audited production servers lack basic OAuth authentication. These numbers come from research published on arXiv in July 2026. The paper, titled “Exposed by Design,” paints a picture of widespread carelessness. And the MCP Dev Summit held in Seoul on August 13-14, 2026, turned into the place where protocol creators finally faced the security community head-on. Forkast News captured the shift. What began as a technical gathering became a high-stakes reckoning.
Anthropic introduced the protocol in late 2024. The goal was simple. Give AI models a secure, two-way connection to outside systems. Yet the design choices that made MCP easy to implement also opened doors. The STDIO transport mechanism stands at the center of the dispute. OX Security called it a systemic architectural flaw in its April 2026 report. The firm counted 150 million downstream package downloads at risk, more than 7,000 publicly accessible servers and as many as 200,000 vulnerable instances. Anthropic responded that the behavior was intentional. The company described the execution model as a secure default and placed the burden of input sanitization on developers. That stance has not aged well.
But the problems run deeper than one transport method. Red Hat laid out several attack patterns in a detailed analysis. The confused deputy problem appears repeatedly. An MCP server performs actions on behalf of a user. If authorization is not implemented correctly the server can grant access to resources the user should never see. This violates the principle of least privilege. OAuth is part of the specification yet the current version conflicts with many enterprise practices. Updates to the spec are underway. They cannot come soon enough.
Supply chain weaknesses compound the issue. MCP servers consist of executable code. Users must trust every server they install. Developers who create these servers carry the responsibility of signing components and maintaining secure build pipelines. Static application security testing and software composition analysis become mandatory steps. Cloud-hosted servers require cryptographic verification of dependencies. A single compromised package can hand attackers persistent access across multiple services. Red Hat warned that even legitimate-looking updates can swap benign tools for malicious ones.
Pillar Security highlighted token theft as an especially dangerous outcome. An attacker who steals an OAuth token stored by an MCP server can spin up their own instance. They gain the ability to read a victim’s entire Gmail history, delete messages, set forwarding rules or exfiltrate data. The breach looks like legitimate API activity. Password changes offer no protection because the token lives on. Server compromise creates an even larger target. One server often holds credentials for Gmail, Google Drive, calendars and more. The centralized store becomes the keys to the kingdom.
Prompt injection adds another vector. Malicious content hidden inside emails or documents can instruct the AI to take actions the user never intended. The boundary between viewing data and executing commands blurs. In one scenario an attacker embeds instructions that forward sensitive files without any visible sign. The LLM follows the hidden directive. These attacks succeed because many MCP implementations fail to require explicit user confirmation for every sensitive operation.
The U.S. National Security Agency’s Artificial Intelligence Security Center examined the broader picture in a June 2026 document. MCP’s rapid spread outpaced its security model. The protocol launched with a flexible and underspecified design. That choice gave implementers freedom. It also created ambiguity around safe usage. Client-server roles invert in unexpected ways. Servers query and execute on behalf of clients. The resulting attack paths often go untraced. The NSA report listed concrete examples. Tool parameter injection lets adversaries run arbitrary commands. Naming collisions hijack legitimate functions. Unrestricted GitHub access exposes private repositories. One CVE, tracked as CVE-2025-49596, allowed remote code execution inside the MCP-Inspector toolchain through crafted messages. The flaw was fixed in version 0.14.1 yet it illustrated how familiar weaknesses reappear when AI toolchains skip basic hygiene.
OWASP responded with its own framework. The OWASP MCP Top 10 catalogs risks that range from token mismanagement to tool poisoning. Researchers filed more than 30 CVEs against MCP components in the first two months of 2026 alone. Palo Alto Networks Unit 42 measured a 78.3 percent attack success rate when five MCP servers connected to a single AI agent. The numbers no longer surprise security professionals. They reflect what happens when a permission-rich protocol scales faster than governance.
Microsoft, Google, Cloudflare and others have started to publish their own guidance. Windows 11 now requires baseline security controls for any MCP server listed in its registry. Cloudflare detects MCP traffic at the network edge and adds tracing capabilities. These efforts show the industry moving toward defense in depth. Yet many deployments still run without authentication, without sandboxing and without centralized logging. Local servers execute operating system commands. Remote servers pull data from third-party APIs. Both demand strict controls. Few enforce them consistently.
Governance of the protocol has shifted. The Linux Foundation now oversees development through the Agentic AI Foundation. This move removes some vendor influence that previously rested with Anthropic, Block and OpenAI. Neutral ground may allow clearer specifications and stronger defaults. The NSA document argues for exactly that. Secure-by-default behavior must come from implementation rigor, better coding practices, explicit specifications and validation tools. Developers can no longer treat security as an afterthought.
Practical fixes exist. Run local servers inside sandboxes with seccomp or AppArmor. Enforce least-privilege scopes for every OAuth token. Require user approval for every tool call that touches sensitive data. Sign and verify all messages with timestamps and replay protection. Log every prompt, tool invocation and downstream action to a central system that security teams can query. Scan networks for exposed MCP servers. Patch aggressively. These steps sound familiar because they mirror lessons learned from earlier waves of technology. The difference now is the speed of adoption and the power of the models behind the requests.
Some organizations treat MCP as critical infrastructure already. Others experiment without visibility. Security teams cannot manage connections they cannot see. That gap explains why tool poisoning, context spoofing and cross-agent leaks appear in nearly every new threat model. A malicious server can register a helpful-sounding tool that quietly exfiltrates code or secrets. Another can chain requests through legitimate-looking proxies. The composability that makes MCP powerful also makes it dangerous.
The Seoul summit did not produce a single fix. It did surface consensus on one point. The protocol has reached an inflection point. Theoretical risks have become demonstrable exploits. Public labs and independent researchers have released vulnerable implementations to prove the point. Enterprises that once viewed MCP as an experimental convenience must now evaluate it against production security standards. The binary choice is clear. Either harden the architecture at the protocol level or accept that security will remain a perpetual, often inadequate, developer burden.
History offers a parallel. Early web protocols shipped with similar flexibility and later required years of retrofitting. MCP does not have that luxury. AI agents already act on behalf of users across sensitive domains. The cost of getting this wrong is measured in leaked intellectual property, regulatory fines and eroded trust. The path forward demands clearer specifications, mandatory security controls in registries, better tooling for discovery and monitoring, and a cultural shift that treats every MCP server as a potential high-value target.
Security professionals watching the space expect more CVEs. They also expect more mature defenses. The question is whether the industry will move fast enough to close the gap before the next major breach. The data from Seoul suggests the conversation has finally begun in earnest. That alone counts as progress. The real test will come in the implementations that follow.